This is the second part of the Mobile App testing checklist series. The first part is presented here. Continuing the series, we present a checklist of test cases for some more categories.
Network Communication Requirements
Apps serve as the front end and frequently make network calls to backend systems. This interaction involves exchanging critical information like personal details, bank information. Communication with external systems, particularly over the WWW, requires that the data sent should be over a secure channel to prevent it from being compromised.
For Android and iOS
Verify All network traffic goes via SSL
Verify SSL Pinning is enabled.
i.e. Using MITM tools like Charles, verify that the https traffic cannot be decrypted
Platform Interaction Requirements
Modern smartphones offer a bevy of features. Camera, location, Bluetooth, gyroscope, and many more. Apps that use any such feature have to ask for the user’s consent to use the same. It is necessary to verify if the user is prompted to wilfully permit the app to use any feature outside of itself.
For Android
- Verify for dangerous permissions, for all the below permissions an explicit prompt should be displayed to the user
- READ_CALENDAR
- WRITE_CALENDAR
- READ_CALL_LOG
- WRITE_CALL_LOG
- PROCESS_OUTGOING_CALLS
- CAMERA
- READ_CONTACTS
- WRITE_CONTACTS
- GET_ACCOUNTS
- ACCESS_FINE_LOCATION
- ACCESS_COARSE_LOCATION
- RECORD_AUDIO
- READ_PHONE_STATE
- READ_PHONE_NUMBERS
- CALL_PHONE
- ANSWER_PHONE_CALLS
- ADD_VOICEMAIL
- USE_SIP
- BODY_SENSORS
- SEND_SMS
- RECEIVE_SMS
- READ_SMS
- RECEIVE_WAP_PUSH
- RECEIVE_MMS
- READ_EXTERNAL_STORAGE
- WRITE_EXTERNAL_STORAGE
- Verify unnecessary permission are not added in Android.manifest file
- Verify app authentication is required when using Deep Links in the app
- If webviews are displayed inside the app, ensure the url is https, and cannot be decrypted via Charles
- Disable local file access in Code. Check with the developer and see if these restrictions are in place.
- webView.getSettings().setAllowFileAccess(false);
- webView.getSettings().setAllowFileAccessFromFileURLs(false);
- webView.getSettings().setAllowUniversalAccessFromFileURLs(false);
- webView.getSettings().setAllowContentAccess(false);
- Verify that App can be force updated.
For iOS
- Verify app ask user permissions for the following
- Bluetooth peripherals
- Calendar data
- Camera
- Contacts
- Health sharing
- Health updating
- HomeKit
- Location
- Microphone
- Motion
- Music and the media library
- Photos
- Reminders
- Siri
- Speech recognition
- the TV provider
- Verify app authentication is required when using Deep Links in the app
- Verify webviews only load https content. Check the code for WKWebView and verify the following flag “hasOnlySecureContent” is set to true
- Verify Webviews cannot be decrypted via Charles
- Verify Both allowFileAccessFromFileURLs and allowUniversalAccessFromFileURLs are set to “0”, on webviews are set. Check with developers
- Verify that App can be force updated.
Code Quality and Build setting requirements
Apps have a minimum of two configurations; a debug version where the app is not yet optimized for release or customer use. For example, logs would be enabled in the debug version to track bugs while developing. In the debug version, the app can get away with being slower and “fatter.” Apps also have a production version, meant for end-users. Here the app is “thinned” down for the target device on which the app is running. This version is optimized. So when it comes to the production version of the app, it is essential to test the build settings and other aspects used only for the debug version such that it does not leak into the production version.
For Android
Verify APK is Signed correctly.
a. Test using the following command,
apksigner verify — verbose Desktop/example.apk, Following output should be displayed for example,
b. Verified using v1 scheme (JAR signing): true
c. Verified using v2 scheme (APK Signature Scheme v2): true
d. Verified using v3 scheme (APK Signature Scheme v3): true
e. Number of signers: 1
Verify the store build is generated as a “Release” build and not “Debug” build. Using apktool decompile apk and check AndroidManifest.xml, android:debuggable should false
Verify APK is Obfuscated (i.e, Proguard is enabled) and no sensitive data is visible. Decompile the apk using apktool. Convert classes.dex to .jar using d2j-dextojar. View the jar file via JDGUI
Verify all debug logs are disabled. Run adb logcat and check if the apk is displaying any sensitive information
For iOS
Check the ipa is Release Mode and not in Debug Mode. Use Xcode and Check if the app can be debugged.
Check all debug logs are disabled and no sensitive information is logged in Xcode
Verify “Strip Debug Symbols During Copy”, “Strip Linked Product”, “Strip Swift Symbols” are set to Yes in Xcode build settings
Check for vulnerabilities in 3rd party Pods. Run OWASPs tool
dependency-check — enableExperimental — out . — scan Podfile.lock
Resiliency
For Android
Verify apk does not launch on rooted devices.
Checksum of apks should be created and validated against the server every time it’s launched.
For iOS
Verify app does not launch on Jailbroken phones
Obfuscate code with iXGuard and verify via MachoView tool
Source: Security Checklist II
