How the latest MASVS & MSTG Specs Make the Best Mobile Pen Testing Cocktails Brian Reed & Tony Ram

## Overview Brian Reed (Chief Mobility Officer at Now Secure) and Tony Ramirez (Senior Application Security Analyst at Now Secure) present a comprehensive guide to mobile application security testing using the MASVS (Mobile Application Security Verification Standard) and MSTG (Mobile Security Testing Guide). The presentation emphasizes that 70% of digital traffic now occurs on mobile, yet mobile security testing capabilities lag significantly behind web security practices.

## Key Statistics & Context Mobile apps present a substantially larger attack surface than web applications: 85% of tested apps fail one or more OWASP Top 10 mobile requirements, 70% leak GDPR-regulated data, approximately 50% exhibit insecure data storage (M2), 48% have insecure communication (M3), and 48% contain detectable extraneous functionality. The fundamental difference stems from architecture—98% of web code runs behind hardened perimeters, while mobile code executes on untrusted, easily-reversed devices in the wild.

## Anatomy of Mobile Attacks Bad actors follow a predictable pattern: download apps from app stores, reverse them using tools like Radare2 and Frida, then interactively manipulate inputs/outputs. Nearly 99% of apps leak personally identifiable information; attackers can map API endpoints and discover network vulnerabilities. Approximately 50% of apps have certificate validation failures, enabling phishing endpoint attacks. This understanding drives the need for comprehensive testing frameworks.

## Tony's 10 Best Practices 1. **Understand MASVS/MSTG**: MASVS provides security requirements; MSTG supplies testing methodologies across iOS, Android, and hybrid frameworks. 2. **Use diversified tools**: No single tool covers all scenarios; leverage jailbroken/rooted devices, open-source tools, and eventually automation for high-risk scenarios. 3. **Inventory your apps**: Determine which apps require testing and their priority levels. 4. **Learn the attack surface**: Mobile encompasses code functionality, data at rest, data in motion, and backend APIs—broader than web. 5. **Data storage & encryption**: Verify how data is stored, accessed, and encrypted; test data wiping on failed authentication attempts. 6. **Client-side security**: Unlike web browsers, mobile platforms don't enforce certificate validation by default; developers must code this explicitly. Hardware-backed encryption and build settings are essential. 7. **Network security**: Test certificate validation, implement certificate pinning where appropriate, and verify HTTPS on all requests. Use proxies like mitmproxy to inspect TLS tunnels. 8. **Authentication & session management**: Both stateful and stateless models must be server-side enforced. Test biometric flows, multi-factor authentication, rate limiting, authorization, and logic flaws. 9. **Reverse engineering resilience**: These controls—tampering prevention, code obfuscation, device binding, payload encryption—must complement, not replace, security controls. Root/jailbreak detection alone cannot fix underlying vulnerabilities. 10. **Policy, privacy & developer partnerships**: Establish baselines using MASVS's AppSec Model (4 tiers: standard security, defense-in-depth, reverse engineering resilience, combinations). Privacy is now regulatory. Developers are allies—collaborate on secure coding practices, OS feature updates, and threat modeling.

## MASVS Specification Updates Recent changes include enhanced WebView practices (content storage, loading source, device access), third-party keyboard support requirements, overlay detection (especially for financial apps), encryption for sensitive data, and evolving build settings (scoped storage, app signing keys). Data retention policies and memory-vs-storage decisions reflect maturation in platform capabilities.

## Testing Approach & Tools Best-in-class testing combines four methodologies: static analysis, dynamic analysis, interactive testing, and API testing. Recommended tools include Frida, Radare2, Burp Suite, and mitmproxy. Test the binary rather than source code, since mobile involves multiple languages and development environments. For organizations with many apps, employ threat modeling and tiered risk strategies: automate lower-risk apps, manually pen-test higher-risk ones. Integration into the software development lifecycle via secure coding practices, software composition analysis (SCA), and secure code analysis (SAST) enables shift-left security. Monitor production behavior for bug fix releases and change requests that may introduce new vulnerabilities.

## Key Takeaway Mobile and web security are fundamentally different disciplines requiring dedicated expertise, diverse tooling, and close developer collaboration. The MASVS/MSTG provide comprehensive guidance; the field faces a severe shortage of skilled analysts—making it a lucrative career path for those willing to master the attack surface and testing methodologies.