MSTG-NETWORK-1-4 Fix Network Security Testing on Android and iOS (by @NowSecure) #2042

cpholguera · 2022-01-25T11:30:14Z

Both Android and iOS cover now MSTG-NETWORK-1, MSTG-NETWORK-2, MSTG-NETWORK-3, MSTG-NETWORK-4
- Some Tests were split to cover only one MASVS requirement.
- NEW: MSTG-NETWORK-1 on both Android and iOS!
Fix Network Testing chapters structure and cohesion.
Fix all network cross-chapter references and corrected some content location.

…-refs

TheDauntless

Many of them are simple accepts, a few of them are a bit more work :)

Document/0x04f-Testing-Network-Communication.md

Document/0x04g-Testing-Cryptography.md

Document/0x05c-Reverse-Engineering-and-Tampering.md

Document/0x05g-Testing-Network-Communication.md

TheDauntless · 2022-01-26T22:06:50Z

Document/0x05g-Testing-Network-Communication.md

+
+When running on Android 7.0 (API level 24) or higher, apps targeting those API levels will use a default Network Security Configuration that doesn't trust any user supplied CAs, reducing the possibility of MITM attacks by luring users to install malicious CAs. However, this protection can be bypassed by using a custom Network Security Configuration with a custom trust anchor indicating that the app will trust user supplied CAs.
+
+Use a decompiler (e.g. jadx or apktool) to confirm the target SDK version. After decoding the app you can look for the presence of `targetSDK` present in the file apktool.yml that was created in the output folder.


Suggested change

Use a decompiler (e.g. jadx or apktool) to confirm the target SDK version. After decoding the app you can look for the presence of `targetSDK` present in the file apktool.yml that was created in the output folder.

Use a decompiler (e.g. jadx or apktool) to confirm the target SDK version. After decoding the app you can look for the presence of `targetSDK` in the file apktool.yml that was created in the output folder.

apktool technically is a disassembler though, not a decompiler.

This was one block I simply moved around I didn't see that so thanks for telling! We have to change it. I assume it just want to say: unpack and check that value in the android manifest.

This is one of many cases where having a "Techniques" chapter we can refer back to will come handy. This way we don't have to explain that you need to unzip the APK, decode the Android Manifest..but you can achieve the same by ...blah blah We'd simply have "Checking a value from the Android Manifest" including all alternatives. And here we'd just say: ["Check that the value minsdk is ... in the Android Manifest"](linktotechniques#checking-a-value...).

Definitely agree! In general, there are multiple locations where a link would be better than saying the same thing over and over again (e.g. Burp / ZAP)

Document/0x06g-Testing-Network-Communication.md

TheDauntless · 2022-01-26T22:40:49Z

I obviously meant to click 'Request changes' rather than 'Approve' :/

Co-authored-by: Jeroen Beckers <info@dauntless.be>

…int Identify Verification; fix Certificate Pinning in the Network Security Configuration

…ns in Android Developers;

… link from 0x05b

…inning to 0x04f and bypass pinning to 0x05b

…-network-refs

TheDauntless

😅

TheDauntless · 2022-01-27T13:03:49Z

Document/0x05g-Testing-Network-Communication.md

+
+When running on Android 7.0 (API level 24) or higher, apps targeting those API levels will use a default Network Security Configuration that doesn't trust any user supplied CAs, reducing the possibility of MITM attacks by luring users to install malicious CAs. However, this protection can be bypassed by using a custom Network Security Configuration with a custom trust anchor indicating that the app will trust user supplied CAs.
+
+Use a decompiler (e.g. jadx or apktool) to confirm the target SDK version. After decoding the app you can look for the presence of `targetSDK` present in the file apktool.yml that was created in the output folder.


Definitely agree! In general, there are multiple locations where a link would be better than saying the same thing over and over again (e.g. Burp / ZAP)

TheDauntless · 2022-01-27T13:05:08Z

Document/0x06g-Testing-Network-Communication.md


-For more information on this topic please consult the [blog post by NowSecure on ATS](https://www.nowsecure.com/blog/2017/08/31/security-analysts-guide-nsapptransportsecurity-nsallowsarbitraryloads-app-transport-security-ats-exceptions/ "A guide to ATS").
+> **Apple Recommendation: Configure Exceptions Only When Needed; Prefer Server Fixes**: It’s always better to fix the server when faced with an ATS failure. Exceptions reduce the security of your app. Some also require justification when submitting an app to the App Store, as described in the next section.


Document/0x02b-MASVS-MSTG-Adoption.md

Document/0x04f-Testing-Network-Communication.md

Document/0x05g-Testing-Network-Communication.md

Document/0x04f-Testing-Network-Communication.md

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Document/0x06g-Testing-Network-Communication.md

Co-authored-by: Jeroen Beckers <info@dauntless.be>

cpholguera added 5 commits January 25, 2022 08:50

fix refs to network chapters

cc3a635

fixes for 0x4f

c8d998d

Merge branch 'master' of github.com:OWASP/owasp-mstg into fix-network…

0fa5d4c

…-refs

fix links in 5a

76fc70e

Fix MSTG-NETWORK testing for 1,2,3,4 across 0x4f, 0x5g and 0x6g

60f0540

cpholguera added the change-mstg label Jan 25, 2022

cpholguera requested a review from TheDauntless January 25, 2022 11:30

TheDauntless approved these changes Jan 26, 2022

View reviewed changes

cpholguera and others added 20 commits January 26, 2022 23:42

Update Document/0x04f-Testing-Network-Communication.md

d5bb596

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x04g-Testing-Cryptography.md

4b6e819

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x05c-Reverse-Engineering-and-Tampering.md

b7a6440

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x05g-Testing-Network-Communication.md

339ce6d

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x05g-Testing-Network-Communication.md

0aa9dc2

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x05g-Testing-Network-Communication.md

80ebc34

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x06g-Testing-Network-Communication.md

e8fe77d

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x06g-Testing-Network-Communication.md

7b68d2f

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x06g-Testing-Network-Communication.md

411d4f6

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x05g-Testing-Network-Communication.md

aaae5fc

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x05g-Testing-Network-Communication.md

024d5fe

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x06g-Testing-Network-Communication.md

592de8f

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x06g-Testing-Network-Communication.md

c256294

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x06g-Testing-Network-Communication.md

c38f74c

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x06g-Testing-Network-Communication.md

1d0a22d

Co-authored-by: Jeroen Beckers <info@dauntless.be>

fix instant apps outline

1a6bb17

fix md link

04465eb

add Network Security Configuration general section; fix Testing Endpo…

99625e8

…int Identify Verification; fix Certificate Pinning in the Network Security Configuration

fix pinning

461574a

add monitor logs technique; add statement About Pinning Recommendatio…

0eeaf7e

…ns in Android Developers;

cpholguera requested a review from TheDauntless February 3, 2022 10:34

cpholguera added 4 commits April 6, 2022 15:03

include general section about secure connections

989beb0

add section about Android Network Security Configuration in 0x05g and…

4d7546c

… link from 0x05b

add individual tests to MSTG-NETWORK-1, refactor general info about p…

83abce9

…inning to 0x04f and bypass pinning to 0x05b

fix bypassing cert pinning

03f671b

cpholguera added the MASVS-NETWORK label May 7, 2022

cpholguera changed the title ~~Fix Network Security Testing on Android and iOS~~ Fix Network Security Testing on Android and iOS (by @NowSecure) May 7, 2022

TheDauntless requested review from TheDauntless and removed request for TheDauntless June 28, 2022 08:02

cpholguera added 8 commits June 29, 2022 08:41

Merge branch 'master' of https://github.com/OWASP/owasp-mstg into fix…

8d340d2

…-network-refs

Merge branch 'master' of https://github.com/OWASP/owasp-mstg into fix…

4490fd8

…-network-refs

md linting fixes

1710eb9

fix links

40db0f8

fix typos

fdb038d

fix links

9cdf6c3

fix img format

bb51608

add 6g enhancements

918fbee

TheDauntless requested changes Jul 8, 2022

View reviewed changes

cpholguera commented Jul 8, 2022

View reviewed changes

Document/0x04f-Testing-Network-Communication.md Show resolved Hide resolved

Apply suggestions from code review

68eea48

Co-authored-by: Jeroen Beckers <info@dauntless.be>

cpholguera commented Jul 8, 2022

View reviewed changes

Document/0x06g-Testing-Network-Communication.md Outdated Show resolved Hide resolved

cpholguera commented Jul 8, 2022

View reviewed changes

Document/0x06g-Testing-Network-Communication.md Outdated Show resolved Hide resolved

cpholguera and others added 5 commits July 8, 2022 18:16

Apply suggestions from code review

23bfe39

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Apply suggestions from code review

1b2f3a8

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Update Document/0x04f-Testing-Network-Communication.md

401e764

Co-authored-by: Jeroen Beckers <info@dauntless.be>

fix bsi

1059269

fix md lint

196625e

TheDauntless approved these changes Jul 12, 2022

View reviewed changes

cpholguera merged commit 96b4dec into master Jul 12, 2022

cpholguera deleted the fix-network-refs branch July 12, 2022 14:27

cpholguera changed the title ~~Fix Network Security Testing on Android and iOS (by @NowSecure)~~ MSTG-NETWORK-1-4 Fix Network Security Testing on Android and iOS (by @NowSecure) Sep 6, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MSTG-NETWORK-1-4 Fix Network Security Testing on Android and iOS (by @NowSecure) #2042

MSTG-NETWORK-1-4 Fix Network Security Testing on Android and iOS (by @NowSecure) #2042

cpholguera commented Jan 25, 2022

TheDauntless left a comment

TheDauntless Jan 26, 2022

TheDauntless Jan 26, 2022

cpholguera Jan 26, 2022

TheDauntless Jan 27, 2022

TheDauntless commented Jan 26, 2022

TheDauntless left a comment

TheDauntless Jan 27, 2022

TheDauntless Jan 27, 2022


		When running on Android 7.0 (API level 24) or higher, apps targeting those API levels will use a default Network Security Configuration that doesn't trust any user supplied CAs, reducing the possibility of MITM attacks by luring users to install malicious CAs. However, this protection can be bypassed by using a custom Network Security Configuration with a custom trust anchor indicating that the app will trust user supplied CAs.

		Use a decompiler (e.g. jadx or apktool) to confirm the target SDK version. After decoding the app you can look for the presence of `targetSDK` present in the file apktool.yml that was created in the output folder.


		For more information on this topic please consult the [blog post by NowSecure on ATS](https://www.nowsecure.com/blog/2017/08/31/security-analysts-guide-nsapptransportsecurity-nsallowsarbitraryloads-app-transport-security-ats-exceptions/ "A guide to ATS").
		> Apple Recommendation: Configure Exceptions Only When Needed; Prefer Server Fixes: It’s always better to fix the server when faced with an ATS failure. Exceptions reduce the security of your app. Some also require justification when submitting an app to the App Store, as described in the next section.

MSTG-NETWORK-1-4 Fix Network Security Testing on Android and iOS (by @NowSecure) #2042

MSTG-NETWORK-1-4 Fix Network Security Testing on Android and iOS (by @NowSecure) #2042

Conversation

cpholguera commented Jan 25, 2022

TheDauntless left a comment

Choose a reason for hiding this comment

TheDauntless Jan 26, 2022

Choose a reason for hiding this comment

TheDauntless Jan 26, 2022

Choose a reason for hiding this comment

cpholguera Jan 26, 2022

Choose a reason for hiding this comment

TheDauntless Jan 27, 2022

Choose a reason for hiding this comment

TheDauntless commented Jan 26, 2022

TheDauntless left a comment

Choose a reason for hiding this comment

TheDauntless Jan 27, 2022

Choose a reason for hiding this comment

TheDauntless Jan 27, 2022

Choose a reason for hiding this comment