Increase the security of your app(s) with mobile app pentests
Personal information, photos or account details - apps store a lot of sensitive data. However, these private data is at risk if applications are not adequately protected against potential hacker attacks.
With the help of needs-based penetration tests (pen tests), we will test the security of your app(s) and support you in securing them in the best possible way against cyberattacks and data theft. To do this, our experts review established security measures, determine specific risks and uncover vulnerabilities.
Professional testing of your Android or iOS app according to MASVS
Our experts check your app in accordance with the requirements of the OWASP Mobile Application Security Verification Standard (MASVS), among others.
Your app optimally protected against attacks
Using pentests, our experts uncover potential vulnerabilities within your mobile app before cybercriminals can exploit them.
Report with recommendations for corrective action
You will receive a detailed report containing the results of the tests and possible recommendations for action to eliminate weaknesses.
What is an app pentest?
An app penetration test (mobile app penetration testing) is an IT security measure used to check and evaluate the security of mobile applications (in short: apps).
The aim is to identify potential vulnerabilities and points of attack at an early stage and thus increase the security of the tested app. Trained IT security experts use methods and means that real attackers would also use.
Would you like to find out more? Please feel free to contact us!
Pentests against apps: Your benefits at a glance
Detection of potential vulnerabilities
Pentests allow you to identify potential vulnerabilities in your mobile app and proactively close them.
Higher IT security, lower IT risks
Pentests help you to increase the security of your mobile app and reduce potential security risks.
Pentests according to recognized standards
We test your app based on the Mobile Application Security Verification Standard & Mobile Security Testing Guide.
Trust by customers & business partners
An independent security analysis of your app strengthens the trust of your customers & business partners.
Avoidance of economic & reputational damage
With the help of pentests, you can prevent possible attacks & protect yourself from the associated damage.
Continuous optimization of IT security
By uncovering optimization potential, you continuously improve the IT security of your app.
Final test report including recommendations for action
In addition to the test results, we also provide you with recommendations for remedying weaknesses.
Automated and manual pentests
Useful addition of manual tests that are generally not found using automated tools.
Our services: 3 types of pentests against apps
Spot Check
– Level 1
Random assessment of the security level of your app with regard to vulnerabilities.
Random sample / First assessment
Regular Pentest
– Level 2
Analysis to assess the security, with the aim of determining the most common risks and vulnerabilities for apps.
For most applications
Advanced Pentest
– Level 3
A more in-depth analysis that, in addition to Level 2, also identifies risks and vulnerabilities that are difficult to exploit, especially through additional test cases.
High security level
Procedure of a mobile app pentest
1.
Preparation & Kickoff
Discussion of specific technical & organizational features and the prerequisites.
2.
Information Gathering & Analysis
Gathering the essential information about the app to be examined.
3.
Performance of Penetration Tests
Analysis of the selected app(s) based on the information collected.
4.
Final Report
Summary of all test results in the form of a meaningful final report.
Optional: Re-Test
Check whether the implemented improvement & defense measures are working (effectively).
This is being tested
As part of the penetration test, a mobile Android / iOS app is automatically and manually examined for security vulnerabilities. The aim is to identify the most critical or most frequently exploited security risks for mobile apps.
Data storage: Data loss can be caused not only by theft, loss or unauthorized access to a device, but also by malicious apps. Among other things, it checks how the app processes, transmits and stores data on the device.
Network communication: Secure data transmission is an important aspect, especially for mobile devices. One of the checks is whether the data is securely encrypted during transport and whether (TLS) certificates are correctly checked.
Platform interaction: Mobile operating systems differ from desktop operating systems in many ways. For example, permissions are assigned per app. There is also an interprocess communication (IPC) for data exchange. These and other functions are checked regarding safe security.
Authentication and session management: The protection mechanism of the app or the app's data against unauthorized access is checked. The focus here (if applicable) is also on the API endpoints (backend systems)
Cryptography: Data protection plays a particularly important role when it comes to mobile devices. One of the checks is whether up-to-date cryptographic procedures and algorithms are used, e.g. for storing data.
Manipulation resistance/resilience: If the app is protected against unauthorized manipulation, this will further increase security, e.g. against reverse engineering.
API endpoints / backend: Almost every app communicates with backend services (API endpoints). These must also be taken into consideration during an app pen test and are often vulnerable to the same types of attacks that can occur with web applications. For this reason, the OWASP Top 10 Vulnerabilities for Web Applications/APIs (where possible) are also randomly included.
Frequently asked questions (FAQ):
The final report is always created individually and in an easily understandable form by our experts (no automatic generation) and contains at least the following information:
- Introduction: A brief description of the test object and the aim of the pentest.
- Management/Executive summary: A summary of the results.
- Risk assessment: Assignment of a degree of risk to each vulnerability (Informative, Low, Medium, High or Critical Risk), with which the criticality of the respective vulnerability is described.
- Clear representation: Clear representation of all identified vulnerabilities in a table.
- Detailed description of vulnerabilities & Proof-of-Concept: For each vulnerability there is an individual description that reflects precisely how the vulnerability was found and how it can be exploited by an attacker (proof-of-concept).
- Evaluation of automated tests: The results of the automated tests are evaluated by the TÜViT experts, checked for false/positive results and then summarized in the report.
- Recommend measures to remedy the vulnerability: For each vulnerability, there is a recommended measure to eliminate the vulnerability.
- References: If available, we provide references to vulnerability databases (e.g., CVE).
- Technical Appendices: If available, further information and files on the tests performed are provided as an Appendix, e.g. the raw results of the port and vulnerability scans.
- Black box
Pentest without additional information
- Gray box (standard)
Pentest with additional information, e.g. test access data and (API) documentation
- White box
Pentest with further additional information, e.g. architecture/design documents, communication matrix or source code in addition to test access data
The approach of the TÜVIT experts is based on the OWASP Mobile Application Security Verification Standard (MASVS), which defines basic security requirements for mobile apps, and the Mobile Security Testing Guide (MSTG), which describes how the requirements from the MASVS can be verified.
The test duration depends on the selected type of analysis (Level 1 to 3) – see above. Notwithstanding the test period, a period of at least 1 week is assumed for the Spot Check (Level 1) or at least 2 weeks for the Regular (Level 2) and Advanced (Level 3) Pentest.
The costs depend on the type of check selected (levels 1 to 3) as well as the complexity of the subject of the check. A Spot Check is in the lower to mid four-digit range. The Regular Pentest is in the upper four-digit or lower five-digit range and the Advanced Pentest starts in the lower five-digit range. For an accurate price indication, we need more information about your app.
Why we are a strong partner for you
Independence
Expertise
International network of experts
Industry experience
Tailor-made for you
Further services
Enhanced Security Services
