Mobile Rules the World - Jump into Mobile AppSec with the OWASP MAS Project

The talk starts from the gap between how much time people spend in mobile apps and how little mobile application security testing often receives. It introduces the OWASP Mobile Application Security (MAS) project, including its verification standard, testing guide and checklists, and explains how the mobile attack surface differs from the web. Examples include malicious third-party SDKs and breaches in which a mobile app was used to map back-end systems.

The middle of the talk presents results from an automated benchmark of several thousand popular App Store and Google Play apps, grouped by MASVS control category. Network communication, platform interaction and code quality were among the most frequent failure areas, with many findings traced to third-party libraries and to developers switching off the platforms' built-in secure networking defaults. Storage and cryptography problems were also common. Anti-tampering was presented as a way to raise the effort needed for reverse engineering, not as a fix for underlying flaws. The talk also covered privacy controls being added to MASVS, Apple's privacy labels and manifests, and Google's independent security review program.

For practitioners, the main takeaways are to learn where mobile differs from web, focus testing on the categories with the weakest results, test error conditions and authentication flows, and turn the project's material into developer guidance and training.