SEC575: iOS and Android Application Security Analysis and Penetration Testing

This section provides a comprehensive examination of iOS security architecture and penetration testing methodologies. Using Corellium's virtualized environment, students gain hands-on experience analyzing iOS security controls, application data storage, and inter-app communications. We also cover jailbreaking techniques and malware threat assessment.

Section two delves into Android's open-source architecture and varied security landscape. Students learn Android's unique inter-app communication methods, including services, intents, and content providers. Participants gain experience with root access techniques, filesystem analysis, and malware investigation, including ransomware and banking trojans.

This section focuses on evaluating mobile application risks through static analysis techniques. Students learn to use both automated and manual assessment tools for iOS and Android apps, progressing from simple to obfuscated applications. Special attention is given to analyzing various application frameworks and their specific security challenges.

Building on static analysis skills, this section explores runtime application analysis and modification. Students learn to use advanced instrumentation frameworks for both Android and iOS, including Cycript, Frida, and Objection. The section concludes with implementing the OWASP MASVS standard for comprehensive security assessment.

The final technical section's topic focuses on comprehensive mobile penetration testing, including back-end server assessment and man-in-the-middle attacks. Students learn to bypass security controls, access locked devices, and create sophisticated Remote Access Trojans for red team engagements.

This culminating section integrates all course concepts into a comprehensive practical challenge. Students analyze multiple applications and forensic images, identifying vulnerabilities and sensitive data exposure while applying real-world mobile security assessment techniques.