Case Study 1: IT Services Consultancy | Location: Noida, India
Valency Networks performed Mobile Application Vulnerability Assessment and Penetration Testing for a top Hardware consultancy. During the testing process a critical issue in their mobile application was identified. The security methods used by the mobile application, such as OTP would be easily bypassed by attackers. The attacker had the ability to completely take over the victim's account. Any user without any privileges could have their account successfully taken over by an attacker. The risk of unauthorized individuals accessing an organization's data can be reduced with properly designed mobile app authentication.
Valency Networks team has expertise in finding such critical vulnerabilities. Our approach helps our customers in fixing the issues timely.
We advise our clients to regularly schedule vulnerability assessments and penetration tests in order to prevent such events. Even if significant modifications are not made to the application's coding, VAPT should still be performed because attacks and hacking methods are always evolving. It is your responsibility to have your application security tested in order to protect your key apps from the most recent assaults.
Case Study 2: Manufacturing Industry | Location: Bangalore
We had a leading Online Transport Service Provider approach Valency Networks for VAPT of their Mobile Application. During the testing process, we observed that the application was vulnerable to the following DAR vulnerabilities:
- External storage access found, by default external storage data is world readable and writable. Any App can read data written to External Storage. This vulnerability may result into extraction of the app's sensitive information via mobile malware leading to Identity theft, Privacy violation, Fraud, Reputation damage.
- Sensitive information is being exposed or leaked on the device, by being written in the system log (Logcat). A stolen device or malware application can cause data leakage. This vulnerability may result into sensitive information exploitation. And it can enable attackers to obtain sensitive data such as usernames, passwords, tokens, database details etc. Further it may hamper confidentiality as anyone can read the information by gaining access to the channel being used for communication.
Not fixing small issues like this can lead to major attacks. Our testing approach not only includes DAR, but also DIT checks. Therefore, conducting VAPT regularly from our endorsed technical team is highly recommended.
Case Study 3: SaaS Provider | Bangalore
A Solar Digitization Platform approached Valency networks for their mobile application testing. After conducting a deep VAPT and by our experience we could identify the following vulnerabilities in their application:
- SSL pinning bypass. Apps employ SSL pinning to determine whether they are using HTTPS to communicate with the intended host. This lowers the assault surface and offers defense against the attacks. This was being bypassed easily.
- Unprivileged Access of Privilege URLs (UAPL)was discovered. This vulnerability enables the attacker to modify the permissions in order to delete or steal data, adding or deleting users. And lead to privilege escalation. Also, it can lead to gaining access to applications or data on a system with higher privileges than the original compromised account. Further leading to Deployment of additional malicious payloads on a target system and application Crash.
Like this customer, many customers have misconceptions that android and iOS take care of the security themselves. This is not the case at all, there are a numerous loophole that could be exploited to tamper with the mobile application security. Our exhaustive testing and the explanation helped the customer understand the need for SSL pinning. To prevent such blunders, periodic Vulnerability Assessment and Penetration Testing is must.
Case Study 4: Human Health Activities Organization |Bhopal
A Vulnerability Assessment and Penetration Testing was conducted for a Human Health Activities Organization. We encountered the following vulnerabilities in their application:
- Misconfigurations on server side like misconfigured headers leading to CORS and server information leakage.
- CORS stands for Cross-origin Resource Sharing. This vulnerability impacts the confidentiality and integrity of data by allowing third-party sites to carry out privileged requests as authenticated users such as retrieving user setting information or saved payment card data.
- Server version information disclosure can lead to attacks performed by referring to CVE. Also, it can lead to server take over.
- Privilege Escalation enables the attacker to modify the permissions in order to delete or steal data, adding or deleting users. Also, it can lead to gaining access to applications or data on a system with higher privileges than the original compromised account. Further leading to Deployment of additional malicious payloads on a target system and application Crash.
To avoid all the aforementioned vulnerabilities, it is crucial to have Vulnerability Assessment and Penetration Testing done before going live with the application. Valency Networks has an expertise in testing and finding critical vulnerabilities. Mobile vulnerability assessment helps increase performance of the overall application and improve security with better support and periodic patching.
Case Study 5: Healthcare Industry | USA
We provided Vulnerability Assessment and Penetration Testing and Compliance check services to a leading healthcare industry. While testing, we came across various flaws in their application. They are as follows:
- We discovered ADB Log vulnerability that resulted into sensitive information exploitation. And it can enable attackers to obtain sensitive data such as usernames, passwords, tokens, database details etc. Further it may hamper confidentiality as anyone can read the information by gaining access to the channel being used for communication.
- PII (Personal Identifiable Information) data leakage was found. This vulnerability lets attacker obtain sensitive data such as usernames, passwords, tokens, database details etc. Further it hampers confidentiality as anyone can read the information by gaining access to the channel being used for communication.
We offer a range of compliance services to our customers. They are as follows:
- HIPAA: HIPAA stands for Health Insurance Portability and Accountability Act. HIPAA assures patient information protection, offers physical and electronic security of patient information, restricts exposure of information to what is absolutely necessary, specifies patient rights to the information, reduces fraud and abuse, and streamlines bill and other transaction processes. All necessary physical, network, and process security measures must be in place and adhered to by any business that deals with PHI (protected health information).
- GDPR: To prevent any data breaches, GDPR (General Data Protection Regulation) mandates that the PII be processed in a safe manner. As a result, it's crucial to constantly check for vulnerabilities in all the systems, resources, apps, and other facilities that store and handle PII. VAPT can be used to accomplish this on a regular basis.
- PCI DSS: Regardless of size, we offer PCI DSS ASV scanning services to businesses that receive, transfer, or store any cardholder data. It guarantees that your computer systems are protected from security flaws or hacker attacks. It assists your company in taking a step in the direction of HIPAA, SOX, etc. It also enhances the strategy and return on investment of your company's IT assets.
These compliance checks make Valency Networks a distinctive security provider. Inclusion of compliances makes us stand out in the Cybersecurity Solution market.
Case Study 6: Cloud Gaming Industry | Pune, India
We have been providing Mobile VAPT services for this customer for couple of years. They are into hosting, managing, developing gaming Apps. It was important for them to get their apps tested as few of the apps were dealing with coins and payment.
Our customer's concern was to ensure the payment is secure as per PCIDSS compliance and ensure the authentication mechanisms being used cannot be bypassed. We performed a through mobile App VAPT where the Data-At-Rest and Data-In-Transit were tested. Checks pertaining to PCIDSS were also conducted to sure sensitive payment details are not being stored or transmitted in paint test format.
In the beginning, we had found quite a few vulnerabilities in the apps related to misconfigurations. We a call with customer team on exampling the vulnerability report that we shared along with the right fixation methods to be followed. Since they got the clarify and understanding the vulnerabilities, in the following App VAPTs they ensure they fix these issues before coming for the testing.
With all the hardening, still they come for regular VAPT of the Apps because they have understood that only with regular VAPT, their apps can be secure from the latest threats and attacks.
Case Study 7: Healthcare Services | Texas, USA
One of the Healthcare services companies approached us for performing VAPT combined with HIPAA compliance checks for their mobile apps - Android and iOS. Since their App mainly dealt with patient details and their medical conditions, they were very concerned about the PHI data.
We saw the seriously of the application and dived into the vulnerability Assessment and Penetration testing phase. During the testing it was observed that the DIT, i.e., the data being transmitted from the mobile app to the backend server was quite secure and no PHI data was found to be insecure.
However, when we were testing the DAR i.e., the app data that gets stored on the device, we found that PHI data were being stored in plain text. It was also identified that unnecessary permissions and flags were being allowed on the code level. All these issues were reported and customer ensured to fix them before coming for the retest. And during the retest all the once open vulnerabilities were closed.
If the DAR checks were ignored, customer would have gone through huge loss - monetary, reputational as well as legal. As much as data is transit security is important, equally data at rest security is important. We at Valency Networks ensure complete security of your Apps.
Case Study 8: IT Services & Products Wholesale Industry| Delhi, India
We had provided Android and iOS VAPT services for a company which many dealt with physical access control systems. This app was different for the usual app testing and ensuring the business logic of the app cannot be tampered with is the main concern for the customer.
The testing included by DAR and DIT. As part of DAR, we also performed code review analysis to ensure the source code can be tampered. The testing was completed and the apps DAR was found to be vulnerable. Reverse engineering of binary was possible and App was found to be using unnecessary permissions, exposed communications and possibly harmful functions.
Since customer had a deadline to go live, they were happy that our services helped met their deadline and fix all the issues reported before it. Going live with the App is important but a app that ensures security before going live, assures users of they security.
Case Study 9: Automation Industry | Pune, India
An IoT based industry company approached us to perform VAPT of their Mobile App. They provided both ipa and apk files for testing purpose. Initial stage of the testing, we found that the application was vulnerable to serious attacks such as session hijacking, authentication bypass, installation of app on rooted device, etc.
This was serious because the App was going to be launched soon and security testing was the pending and was treated as unnecessary. Not only were the vulnerabilities found but post authentication session management was completely missing. The seriousness of the vulnerabilities was explained to customer and was suggested to fix them as early as possible.
Security experts suggest that security testing should be implemented from design to develop a secure App or application. If not from the initial phase at least do not ignore till the end when its too late to respond. Our professional tech team are trained to help customer in such situations and solve their queries and concerns. This is most appreciated by our customers along with our technical capabilities.
Case Study 10: Software Development | India
One of our regular customers came for their new Mobile App penetration testing. The testing included both DAR and DIT. However, in the end only DAR testing was possible because they had hardened the SSL pinning so much so that it was impossible to bypass and perform MITM attack for DIT.
This is why we suggest developers to implement SSL pinning as it is important to secure applications from MITM attacks, especially when application hold and transmit confidential information. Due to the misconception that Android and iOS take care of app security, developers because negligent about implementing SSL pinning. However, now the need for it has raised due to the increase in techniques in bypassing SSL pinning. Not implementing not just makes it easier or opens door for hackers and penetration testers to exploit the application.
Refer to more Mobile Pentesting Case Studies
