MobSF: Security analysis of Android and iOS apps
The Mobile Security Framework (MobSF) is an open source framework capable of performing end to end security testing of mobile applications.
MobSF can be used for security analysis of Android and iOS applications. It supports APK and IPA binaries, as well as zipped source code.
“There is no other tool of my knowledge that can do all the things that the Mobile Security Framework does. This inclues static analysis, dynamic analysis, and API fuzzing. It allows you to perform dynamic analysis on a real device, so you can deal with sophisticated apps or malware,” Security Researcher and MobSF Lead Developer Ajin Abraham told Help Net Security.
New in MobSF 0.9
- Responsive UI
- Live device/VM screencast on dynamic analyzer view
- Dynamic SSL testing
- Exported activity tester and PoC generation
- All new REST API fuzzer for security testing backend servers of hybrid mobile apps
- Custom VM and Android device support for MobSF dynamic analysis
- Updated static analyzer rule set
- Recent scan view
- Improved web proxy, error handling and dynamic analyzer logic
- Anti emulator check bypass.
When discussing development efforts, Abraham noted that one of the biggest challenges was was performing dynamic analysis of advanced Android apps. “It was also time-consuming to ensure everything worked seamlessly across Windows, OS X and Linux,” he concluded.
Below are the slides from Abraham’s talk at Nullcon Goa 2016 that provides more technical information and usage examples.