How the latest MASVS & MSTG Specs Make the Best Mobile Pen Testing Cocktails

on YouTube ↗44m

" summary

Covers specific MASVS & MSTG changes (webview storage, third‑party keyboards, platform features) with hard numbers — 85% fail OWASP Top Ten, 50% have insecure local storage, 48% have insecure communications — and hands‑on tooling and results: reversing and live manipulation with frida and radari, rooted/jailbroken forensics, cert‑pinning bypasses, and whether automated binary testing from vendors actually finds the issues. Watch if concrete test cases, surprising failure rates, and working demos matter.

AI-written summary · about

" chapters (26)

1. 0:00Intro
2. 1:58Mobile Powers the World, But Mobile Risk is Pervasive
3. 2:51Mobile Security Challenges by the Numbers
4. 3:15Web & Mobile are Fundamentally Different
5. 4:12Understand the Mobile Attack Surface
6. 6:48Understand the Anatomy of a Mobile Attack
7. 9:57Get started on the right path
8. 10:48Leverage OWASP Mobile Project
9. 11:39Use all Your Senses
10. 13:21Learn the Mobile Attack Surface
11. 14:57Changes in MASVS - Platform Interaction
12. 16:28Sensitive data leaks like an overfilled drink
13. 18:00Changes in MASVS - Data Storage
14. 19:57Don't cringe at client-side security controls
15. 21:55Test network on mobile
16. 23:46Don't water down auth & session mgmt
17. 26:08The order matters: Test first, then resilience
18. 28:43Framework for Setting Policy
19. 30:53Don't mix up Security & Privacy, Not the Same
20. 32:47The flavor palate varies widely
21. 35:13Buy a dev a drink, and they might buy you one too
22. 36:48Tony's Mobile Top Ten Recipe
23. 37:37Summary Recommendations
24. 38:24A Sampling of OSS Tools
25. 38:57Leverage Mobile AppSec Testing Checklist
26. 39:48Build Security Into Your SDLC

" related talks

• 29mInsiders Guide to Mobile AppSec with Latest OWASP MASVSBrendan Hann · Global AppSec US 2021 Virtual
• 29mFixing Mobile AppSecSven Schleier · OWASP AppSec USA 2018
• 45mFast Forwarding Mobile Security With The OWASP Mobile Security Testing GuideJeroen Willemsen · OWASP Global AppSec Amsterdam 2019
• 21mSecuring Mobile Apps with OWASP MASVS & MSTGCarlos Holguera · droidcon Berlin 2022
• 28mOWASP Mobile Application Security (MAS)Sven Schleier, Carlos Holguera · OWASP Global AppSec San Francisco 2024
• 20mMobile Application Security (MAS)Sven Schleier, Carlos Holguera · Global AppSec Lisbon 2024
• 19mFlagship Projects: Mobile Security Testing GuideSven Schleier, Carlos Holguera · OWASP 20th Anniversary 2021
• 30mTopics of Interest: Creating an IoT-connected Mobile App Compliance Program... MASVSB. Reed · OWASP 20th Anniversary 2021