Skip to content
OASAM is the acronym of Open Android Security Assessment Methodology and its purpose is to become a reference framework on Android application vulnerability assessments.
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
oasam-auth-authentication Update README.md Dec 29, 2016
oasam-bl-business-logic Create README.md Dec 29, 2016
oasam-conf-configuration-and-deploy-management Update README.md Dec 29, 2016
oasam-crypt-cryptography Update README.md Dec 29, 2016
oasam-dv-data-validation
oasam-info-information-gathering Update README.md Dec 29, 2016
oasam-is-intent-spoofing Update README.md Dec 29, 2016
oasam-leak-information-leak
oasam-uir-unauthorized-intent-receipt
README.md Update README.md Dec 29, 2016
_config.yml Set theme jekyll-theme-hacker Dec 29, 2016

README.md

OASAM

OASAM is the acronym of Open Android Security Assessment Methodology and its purpose is to become a reference framework on Android application vulnerability assessments.

Portable devices are currently holding the market and consumerization is leading them to business applications, invalidating the obsolete idea of using them strictly for leisure activities. Furthermore, Android is emerging as the most extended operating system in this aspect due to various reasons, including the ease of use and massive distribution of applications. However, in terms of security, no information related with the new vulnerabilities that could lead to an insecure programming on this platform is being disclosed, knowing that this platform has a notable attack surface (the traditional one plus the Android’s own architecture).

On the other hand, despite there are particular works in this respect, a complete and consistent taxonomy of vulnerabilities on specific Android applications that allows cataloguing such vulnerabilitiesdoes not exist.

The OASAM Project purpose is to elaborate a complete and consistent taxonomy of vulnerabilities on Android applications, supporting not only application developers, but also people in charge of looking for vulnerabilities in them.

Security controls are structured in the following sections:

  1. OASAM-INFO: Information Gathering: Information gathering and attack surface definition.

  2. OASAM-CONF: Configuration and Deploy Management: Configuration and deploy assessment.

  3. OASAM-AUTH: Authentication: Authentication assessment.

  4. OASAM-CRYPT: Cryptography: Cryptography use assessment.

  5. OASAM-LEAK: Information Leak: Confidential information leak assessment.

  6. OASAM-DV: Data Validation:User entry management assessment.

  7. OASAM-IS: Intent Spoofing: Intent reception management assessment.

  8. OASAM-UIR: Unauthorized Intent Receipt:Intent resolution assessment.

  9. OASAM-BL Business Logic: Application business logic assessment.

Author: Daniel Medianero

In collaboration with: Victor Villagrá (Review)

Jacobo Torrado (Translation)

You can’t perform that action at this time.