IFN701: Investigation into Security of Mobile Apps Report

This report provides a comprehensive investigation into the security of mobile applications, addressing the growing importance of mobile technology in business and daily life. It explores the evolution of mobile applications, from standalone phones to smartphones and IoT devices, and highlights the increasing security risks associated with these technologies. The report delves into various aspects of mobile app security, including vulnerabilities, threats, and countermeasures, such as unit testing, system testing, and the implementation of security policies. It examines research questions related to the security of mobile applications, including the effectiveness of existing security measures, user awareness of security obligations, and the monitoring of security documents. The report also covers methodologies, including the Waterfall model, and discusses the need for continuous review and adaptation of security measures to address emerging threats. Furthermore, the report analyzes the risks associated with mobile apps, focusing on the Android platform, and offers recommendations for enhancing mobile app security, making this a valuable resource for understanding and mitigating the risks associated with mobile app usage.

Running Head: INVESTIGATION INTO SECURITY OF MOBILE APPS 1
An Investigation into the Security of Mobile Phone Communication Apps
Affiliate Institution
Professor’s Name
Student
Date

INVESTIGATION INTO SECURITY OF MOBILE APPS 2
1.0 Abstract
Information technology is currently widely used all over the world. Technology has made
everything possible and more so has led to improved business standards. Most companies across
the globe have embraced the use of technology to improve their business productivity.
Technology is advancing at a higher rate such that mobile application which will help us to run
our business anywhere we are in have been developed. For this reason, we can manage our
businesses anywhere on the earth surface so long as we are connected to the internet.
Using mobile applications, we can communicate vividly with our customers and as well with our
company employees. Technology advances from a standalone mobile phone, and now we are in
the era of smartphones. With the use of mobile phones such as tablets, IPad, iPhone or
Smartphones, we can carry on with our usual businesses as if we are in office. Even while
transacting, everything is done over the internet. (Wang & Lau, n.d.)
Internet of Things (IoT) is a technology which has enabled us to manage our businesses
everywhere across the earth surface. Through the technology we are connected as one village
even if we are far from each other. The only thing which IoT has done is building trust that we
can do anything over the internet. (Velu, 2016)
In this project report, we will deal with security issues on the mobile application we are using to
transact our businesses. We will ask ourselves some questions before the implementation of this
project. The kind of questions includes; how secure are we to employ these mobile applications
technologies? Is the mobile application reliable to our day to day business processes? What are
the impacts and benefits of the mobile app to the business processes? Does the mobile

INVESTIGATION INTO SECURITY OF MOBILE APPS 3
application receive a positive response from the customers? At what cost does it incur to be
developed?
After discussing the questions, the problem is given a solution to ensure that all the requirements
have been achieved. (Thuraisingham, 2001) The project team members will have to use these
research questions to clearly understand the customer requirements and how secure will be the
system after the solution have been provided. Finally, detectives which will help to detect these
threats will be established so that the threats will be blocked before harming the system.

INVESTIGATION INTO SECURITY OF MOBILE APPS 4
Table of Contents
1.0 Abstract.................................................................................................................................................2
2.0 Introduction...........................................................................................................................................6
2.1 The purpose of the Research.............................................................................................................7
2.2 Research Scope..................................................................................................................................8
2.1 Project Background............................................................................................................................8
2.2 Research Questions...........................................................................................................................9
3.0 Literature review.................................................................................................................................11
4.0 Methodology.......................................................................................................................................12
4.1 Waterfall Model...............................................................................................................................13
4.1.0 Project Planning........................................................................................................................13
4.1.1 Requirements definition...........................................................................................................14
4.1.2 System design...........................................................................................................................14
Design view of how weekly report will be done................................................................................15
4.1.3 Research development process................................................................................................15
4.1.4 Integration and Testing.............................................................................................................15
4.1.5 Installation and Acceptance......................................................................................................15
4.1 Work Break-Down Structure and Weekly Plan................................................................................16
4.1.6 Communication Plan.....................................................................................................................17
5.0 Literature Review Results....................................................................................................................18
5.1 Mobile application...........................................................................................................................18
5.2 Mobile application system vulnerabilities.......................................................................................19
5.3 Mobile Application Testing Method................................................................................................20
5.4 Mobile Application Approval or Rejection.......................................................................................21
5.5 Risks and threats model...................................................................................................................23
5.6 Results Analysis...............................................................................................................................25
5.7 Tools and Services used...................................................................................................................26
6.0 Discussion............................................................................................................................................27
6.1.0 Source Code Testing.....................................................................................................................27
6.2.0 Correctness Testing Method.........................................................................................................28
6.2.0 Managing and Un-mapping Mobile Applications..........................................................................29
6.3.0 Limitation of Approving or Rejecting the Mobile Apps.................................................................30

INVESTIGATION INTO SECURITY OF MOBILE APPS 5
7.0 Reflection of the research...................................................................................................................31
Conclusion.................................................................................................................................................34
References.................................................................................................................................................36

INVESTIGATION INTO SECURITY OF MOBILE APPS 6
2.0 Introduction
Mobile communication is currently the most rapidly growing technology as the world is
targeting every work will in the near future be done at the palm of your hand. The current market
trend for mobile application technologies such as android applications, apple store for IPhone
and many more to name but few are rapidly growing at an alarming rate. As we can witness that
within a short period of time after the release of the handy cell phones, smartphones, tablets,
iPhone and iPad came into being. This is evidence in the sense that mobile technology is
constantly changing over time. (Thuraisingham, 2001)
The change is growing faster because it has caught the warm in the market where every person is
in high demand for it. When the internet was embedded on mobile devices, so many people gain
a higher preference for purchasing a mobile device rather than buying a desktop or laptop
computer. Smartphones this day serve so many transactions, including online payments.
How Mobile Application works

INVESTIGATION INTO SECURITY OF MOBILE APPS 7
This report explains various issues which we may encounter with the use of the mobile
application and the countermeasures we can use to control them. (Mukherjea, n.d.) An
investigation will be carried out to check whether the use of mobile application technology to
transact our business is safe or not.
The most crucial aspect of the implementation of technology is security. Developing a mobile
application without considering its security is a waste of time as a resource. We can ensure that
the mobile application is secure enough by employing various techniques such as unit testing or
system testing. Unit testing is a technique done by programmers during the development stage of
the application, while system testing is done after the development process by testers. This kind
of exercise will help to ensure that the programs we will be deploying for first use are safe and
secure. Also, developing mobile applications is not like in the past. The mobile phone is also
changing their compatibility features like 2G, 3G, 4G and currently we are migrating to the fifth-
generation (5G), WPS Wi-Fi security settings, Bluetooth and NFC. All these are the mobile
application technologies to enhance the security and the functionality of mobile devices. (Makan,
2013) This is in conjunction with the internet of things, and that is the reason why we are
regarding them as an IoT device.
Day in day out, we hear of cases of system hacking. This means that these mobile applications
are not secure at all. This project will expound more on these threats that are affecting our mobile
application systems.
2.1 The purpose of the Research
This record characterizes a mobile application checking process and gives direction in planning
and actualizing an application security process, creating security prerequisites for mobile
applications, recognizing suitable instruments for testing mobile applications and deciding

INVESTIGATION INTO SECURITY OF MOBILE APPS 8
whether a handy application is satisfactory for arrangement on an association's cell phones. An
outline of methods usually utilized by programming confirmation experts is given, including
techniques for testing for discrete mobile application vulnerabilities and misconfigurations
identified with mobile application software. (Hoog, 2011)
2.2 Research Scope
Mobile application exercises for a mobile application may happen in at least one periods of the
smartphone application lifecycle: during the advancement of the application by its engineer (i.e.,
the application improvement stage), subsequent to accepting a created application however
before its sending by the end-client association (i.e., the application obtaining stage) or during
arrangement of the application by the end-client association (i.e., the application organization
stage). These three periods of the mobile application lifecycle are demonstrated as follows (Guo
& Wechsler, n.d.)
2.1 Project Background
Recent researchers have reported that hackers are focusing on android applications to steal. It has
been conceded that android applications are exposing us to attackers and using them is very
risky. They are termed to be not as secure as IOS, which has the detectives for hackers or any
other person entering into the system for ill motives. The reason why the mobile application is

INVESTIGATION INTO SECURITY OF MOBILE APPS 9
becoming a target is that the users are very many. (Chandra, 2009) This means that the system
has a complexity of users, making it more vulnerable to the attackers.
Android application systems for android phone are prone to expose us to spyware programs
which hackers usually use them to steal from our systems. So android must be dealt with in-
depth so that its security features can be improved.
2.2 Research Questions
What policies, guidelines and procedures have been established to ensure that our mobile
applications are secure?
The risk analysis report design by our team of security experts will have to indicate all the
possible procedures and policies established so that it can help us in ensuring that our mobile
applications are totally secure. We are in tandem that our mobile application software, especially
android application, are exposing us to be insecure. (Abraham & Dalziel, n.d.) A number of
people regularly experience a lack of IT security by getting conned over the mobile systems
ending up losing their money or any other property.
Policies and guidelines will help the users to protect the integrity of the company by following
the right procedure while using mobile applications. Every organization will have to set up IT
policies and regulation through which every user has to follow at its latter. (Abraham & Dalziel,
n.d.)
Do the existing security policy/procedures/guidelines adequately state what is allowed or
not allowed to do?
The audit team will be considering the already set rules and procedures which are currently in
use in regards to mobile application procedures of use. In a company, users are trained and given

INVESTIGATION INTO SECURITY OF MOBILE APPS 10
instructions on what to do and not to do. IT risk management department will have to ensure that
the users are trained well in the issues related to security threats. They must be made aware of
various people who may use them to steal the company's property. They should get to know that
their passwords shall never be disclosed to anybody. (Abraham & Dalziel, n.d.)
Protecting the integrity of the system by the staff will enable a strong, secure environment to
carry out daily activities without trials from attackers and red had hackers. As we have seen that
mobile applications are the most affected systems when it comes to security breaches and
hacking. Also, users must be provided strictly with company phones with protected passwords
assigned to each staff. The passwords will be controlled from the main admin system to ensure
that the system integrity is maintained.
Are the users aware of the obligation with regard to the accepted company laws, security
policy and procedures before the access rights are given?
The report will find out if the mobile application users have been made aware of the guidelines
which must be followed keenly. The research team will be able to explain that in detail and what
are the possible consequences to be made in case the staff failed to adhere to the laws provided.
Therefore, in case there is no such guidelines, the team will provide them in the report so that the
management team can implement the same to ensure that the company is running smoothly. By
provisioning, these guidelines to the staff will help to mitigate stealing from the users themselves
However, there is a need in looking into external security as some experts may use some
software call spyware to intrude into the system and steal money or data. Remember the mobile
application has a user end which resides on a mobile phone, but the backend is in the powerful

INVESTIGATION INTO SECURITY OF MOBILE APPS 11
computer server. Most mobile application stores its data over the cloud. Cloud computing is a
technology we shall not rely on that much when it comes to security.
Are there any monitoring and review processes concerning these security documents?
In this research, we will look into the monitoring and review processes where other researchers
are carrying out a similar project. In this regard, references on the same will be made and check
if the findings are similar in one way or another.
Are these security documents regularly reviewed to address the threats that emerged from
new technologies?
The report also will be reviewing the different emerging technologies and the threats emerging in
the field of the mobile application. The report will explain the threats emerging and the possible
breaches which cause these threats to enter into our systems without us noticing them. Preventive
measures are considered and documented to allow users to get to know each type of attack and
how it occurs. (Siegrist, Earle & Gutscher, 2010)
3.0 Literature review
The accompanying paper is writing research on the topic of Mobile Security threats and
beaches. The point has been picked because of the ascent in mobile applications and the deficient
ascent in the theme of security in those applications. The reasons why this paper was written is
that cell phones such as tablet and PDAs, which run a versatile Operating System (OS). These
mobile phones are explicitly Android (Google), IOS (Apple), or BlackBerry OS (RIM).
(Raczkowski, 2017) While it is essential to take note of these terms, this research writing is
centred principally on Android OS security vulnerabilities. Polymorphic is characterized as
malware that changes to be to at some degree, not quite the same as the one preceding. The

INVESTIGATION INTO SECURITY OF MOBILE APPS 12
mechanized alterations in code don't adjust the malware's usefulness. However, they can render
traditional enemy of infection discovery innovation ineffectual against them. An attack vector is
most essentially depicted as the methodology used to ambush a particular innovation (I. e. away
is taken to bargain a framework). A botnet is a gathering of "zombies" which are remotely
controlled for pernicious or monetary benefits. A solitary botnet regularly contains hundreds or
thousands of gadgets. At the point when the expression "defenselessness" is being used inside
this paper, it is a shaky area which enables an assailant to diminish a framework's security.
(Merna & Al-Thani, 2011) A defenselessness happens when three components converge,
including a framework shortcoming or defect, aggressor access to the imperfection, an assailant
fitness to misuse the blemish.
The outcomes accommodation procedure starts after the last application endorsement/dismissal
report is finished by the approving authority and antiquities are set up for accommodation to the
mentioning source. These antiquities may incorporate the last endorsement/dismissal report, test
instrument reports and conceivably a carefully marked rendition of the application that
demonstrates the application has finished the application screening process. The utilization of an
advanced mark gives source verification and respectability insurance, bearing witness to that the
form of the dissected application is equivalent to the rendition that was at first submitted and was
definitely not intentionally adjusted.
4.0 Methodology
A method was chosen while the research was being carried out. Both qualitative and quantitative
research was conducted on the basis of organizing an interview to the relevant group of people.
The people who will be asked the questions are the current users of the mobile application.
Hence the approach which was used to design this report is the waterfall model. (Labbi, 2005) In

INVESTIGATION INTO SECURITY OF MOBILE APPS 13
this model of approach, the components of the project are broken down into units which can be
shared among the team members. Each member has to complete the task within a clear and
assigned time lime provided by the project manager. To establish the security concern regarding
mobile application, a method has to be chosen so that the research process can be completed
successfully. In addition, a work breakdown structure is as well designed to ensure that each
team is assigned a work to be completed within the set timelines. (Klijn, Schweckendiek, Klijn &
Schweckendiek, 2013) Each process has to start after the completion of the other stages until the
last stage is achieved.
4.1 Waterfall Model
The waterfall model was chosen to be used to perform this research. The method was chosen
because it is easy to implement and also to learn. Waterfall model involves a step by step
process, which includes the stages as shown in the diagram below. The start stage is the
requirements analysis, research design (arrangement), implementation (writing/survey),
execution stage (integration and testing, and closing stage (installation and acceptance stage)
(Joseph, 2013)
4.1.0 Project Planning
This is the initial stage in project management. During the case study investigating the security
threats and breaches regarding the mobile application, a plan was designed so that the team
members can follow it. The project plan includes finding possible means which will enhance the
project to be done smoothly. This means include the tools for communication, tools for
performing the research analysis and methods of data collection.

INVESTIGATION INTO SECURITY OF MOBILE APPS 14
4.1.1 Requirements definition
All the requirements which will be used to carry out the research process were analyzed by the
surpervisors and acquired. Requirements include the acquisition of tools to be used in carrying
out the project research. (Hulett, 2013) All the requirements are collected before the start of the
research. This includes both the hardware and software requirements, including the human
resource required to carry out the actual process.
4.1.2 System design
The design in which the project is going to be carried out is established. This is done after the
analysis of all the requirements needed for carrying out the research process. Before the
investigation is done, a layout of how the work is going to be executed is drawn. Data Flow
Diagrams are drawn at this stage to show how the system is going to work. This indicates all the
processes and how they can be integrated together. It shows all the communication processes and
how updates are regularly channelled to the project manager. (Chorafas, 2007)

INVESTIGATION INTO SECURITY OF MOBILE APPS 15
Design view of how weekly report will be done
4.1.3 Research development process
After the design, the real work now starts. This is the practical part of the project where all the
team members now apply all the skills needed for the project. The researchers are sent to the
field to carry out experimental research on the topic to be covered.
4.1.4 Integration and Testing
The research report will now be grouped together, and the results are integrated so that a
compiled report is produced. (Business knowledge for IT in insurance, 2009) Each team in this
stage have to compile all the efforts they have put in together so that a complex report is
generated through integration. This is the overall outcome of the research process.
4.1.5 Installation and Acceptance
The compiled report is put on a final discussion so that each member has to be consulted on what
the report entails. After this, the approval is done by the project manager and the research is
deployed for use.
Team A Team DTeam B Team C
Project
Data
Project Manager

INVESTIGATION INTO SECURITY OF MOBILE APPS 16
4.1 Work Break-Down Structure and Weekly Plan
Work breakdown structure (WBS) is a tool which is used in project management to assign the
task to each team. The task has to be broken down into smaller units, and each unit is assigned a
team. The team is allocated a deadline to complete the task. The allocation of time is done by the
project manager. The team is led by a team lead appointed by the project manager and is
responsible for reporting the progress of the task assigned on a weekly basis. The project
manager is the overall coordinator of the whole project. (Bessis, 2015)
As the research continues, the team members are supposed to be on a continuous discussion to
ensure that the context of the topic is maintained as some people may deviate from the research
topic. The project manager maintains the debate as is the one in charge and provides guidelines
to the group members.
As our report should be on investigation of the security threats and breaches on the mobile
applications, it should stick to that, and the report must indicate all the experimental setups
designed to ensure that the actual research was done. The report must clearly outline the security
issues encountered during the research and the potential threats which causes these threats to
persist in our system.
WB
S
Task Name Duration
0 Research Timeline 13 Weeks
1 Start Phase Week 1,2
1.1 Requirements analysis process
1.2 Feasibility study of the Topic
1.3 Project Charter development
2 Planning Phase Week 3,4
2.1 Develop a Project Plan for the Research
Work
2.2 Develop Weekly Schedule and Task
Breakdown
2.3 Allocate resources to each team

INVESTIGATION INTO SECURITY OF MOBILE APPS 17
2.4 Design a Communication Plan
2.5 Form a group team to conduct research
3 Collect Raw Data & Implement data with
final Report
Week 4,5,6,7,8
3.1 Access Online Library and Conduct Literature
Review
3.2 Data Collection
3.3 Carry out Data analysis for the data collected
3.4 Review and collect findings Week 9,10,11
3.5 Prepare Research Report
3.6 Submission of the Report Week 12
3.7 Closing of the Research Week 13
4.1.6 Communication Plan
After the work breakdown structure have been developed, the team needs to come up with a
communication plan. The communication plan will be used when weekly meetings occurs and
when one need to raise any issue concerning the clarification regarding the requirements of the
project research. The tools used to communicate include the use of emails and direct messaging.
Also, regular meeting has to be held to ensure that the members are up to date. In the meetings
issues can be raised to the concerns regarding any clarification on the research topics.
Mode of
Communication
Duration Purpose Stakeholders
Meeting (Direct
Communication)
At the end of each
week
Discussion of
progress and sharing
of ideas
Project Manager
Email (Indirect
Communication)
As necessary Project updates,
changes in scope and
other requirements
Project Manager
Direct messaging
(mobile phones )
Any time within the
week
Seeking for any help
and clarifications
Project managers

INVESTIGATION INTO SECURITY OF MOBILE APPS 18
The meeting will ensure that progress updates and weekly reports are compiled together and the
necessary action which may have arisen are dealt with. The project manager leads the meeting
and will give more guidelines on how the project is going to work.
The term mobile application called a versatile application has turned out to be exceptionally
prominent. Mobile applications were initially offered for general efficiency and data recovery,
including email, schedule, contacts, and financial exchange watch and climate gauge data. In any
case, open interest and the accessibility of designer devices drove fast venture into different
classes, for example, mobile games, mechanization, GPS and area-based administrations,
versatile banking, request following, and ticket buys. The emission in number and assortment of
utilizations made disclosure a test, which thus prompted the formation of a wide scope of the
survey, suggestion, and curation sources, including web journals, magazines, and devoted online
application revelation administrations.
5.0 Literature Review Results
5.1 Mobile application
The mobile application is also called a versatile application or cell phone application is a product
application intended to keep running on cell phones, tablet PCs and other cell phones. Articles of
various authors written concerning security issues were referred to ensure that the correct results
concerning this research project is achieved. In this report we carried out all the functional
requirements through internet research. Also experimental setups were carried out to ensure that
the actual results are obtain in the research process.The figure below shows the kinds of mobile
applications available in the mobile communication system. They include browser access app,
hybrids access apps,

INVESTIGATION INTO SECURITY OF MOBILE APPS 19
Apps are installed in the device and always require internet connection to run and function. For
example, Social Networking Apps (Facebook, Twitter), Instant Messengers (Skype), ECommerce
(Flipkart), Internet Speed Testing (Speedtest).
Apps are installed in the device and may or may not require internet connection to run and
function. For example, Medical apps and few games in that can be played alone, offl ine and go
online too for playing with multiple players.
Hybrid Apps (Web)
Hybrid Apps (Mixed)4
3
2
1
Type DescriptionS.no
Browser Access Apps
Native Apps
Apps are not installed in the device and can be accessed through native browser by hitting the
URL of the web. The device memory size is not imperative as the app data is not stored in the
device. It is completely dependent on the quality of the browser. For example, m.yahoo.com,
www.google.com.
Apps are installed in the device. They do not need any data transfer to the server and works in the
device without network as the data about the app is stored in the device itself. For example,
Notes and Reminder in iPhones.
5.2 Mobile application system vulnerabilities
The prominence of versatile applications (for cell phones) has kept on ascending, as their use has
turned out to be progressively predominant through the cell phone clients. We can consider being
in each layer as it pursues:
i. Mobile Network Level: block attempt of information over the air. − Mobile Wi-Fi has
issues the same as issues in workstations. − GSM has demonstrated a few splits.
ii. Device Hardware Level: called baseband layer attacks − Memory debasement deserts
(support flood) in firmware used to root gadget.
iii. Mobile Operating System: surrenders in OS piece code or seller-provided framework
code. − iPhone or android jailbroken gadgets are normally abusing these deformities.
iv. Application Level: Mobile applications with vulnerabilities and malevolent code need to
access to client's touchy information and gadget sensors. − Device is not established
entirely over your email and pictures are taken, your area (geo-tagging attack) is
followed, and telephone bill is a lot higher than expected.

INVESTIGATION INTO SECURITY OF MOBILE APPS 20
In this paper, we will talk about just the normal application security dangers found in various
versatile applications regardless of mobile stage suppliers. We see these security hazards
inconsistently in the mobile application systems. When we see them, they regularly appear as
vulnerabilities in the applications we are surveying. Also, this is a decent beginning stage for
security or improvement groups hoping to comprehend the most widely recognized versatile
application security issues and fix them suitably. This paper centres on these threats and
furthermore will talk about versatile risk model.
1. Shaky or superfluous customer side information stockpiling
2. Absence of information assurance in travel
3. Individual Data Leakage
4. Inability to secure assets with solid verification 5. Inability to actualize least benefit
approval approach
5. Customer side infusion
6. Customer side DOS
7. Malignant outsider code
8. Customer side cradle flood
9. Inability to apply server-side controls
5.3 Mobile Application Testing Method
The application testing procedure starts after an application has been enlisted and preprocessed
and is sent to at least one test instruments. A test device is a product device or administration that
tests an application for the nearness of programming vulnerabilities8. Such testing will include
the utilization of various investigation approaches (e.g., static investigation) and might be
performed physically or naturally. Note that the tests performed by a test apparatus may

INVESTIGATION INTO SECURITY OF MOBILE APPS 21
distinguish programming vulnerabilities that are basic over distinctive applications and will
frequently fulfil general application security necessities, (for example, those predetermined by
In the wake of testing an application, a test device will create a report that distinguishes any
recognized programming vulnerabilities or conceivably destructive practices. Also, the report
normally will incorporate a score that gauges the probability that a recognized weakness or
conduct will be misused and the effect the recognized weakness may have on the application or
its related gadget or system. Note that a test device may produce a report that fits in with a
current standard. Further note that some test devices will have the option to recognize
infringement of general application security necessities; however, not an infringement of
association explicit strategies, guidelines, and so forth.
At the point when an application is gotten by testing tools, it is commonly spared as a document
on the instrument merchant's server. On the off chance that the test device is static (i.e., the
application's code is examined), the application is regularly decoded, decompiled or unscrambled
from its double executable structure to a halfway structure that can be analyzed. If the test
instrument is dynamic, the application is commonly introduced and executed on a gadget or
emulator where the conduct of the application can be broken down. After the instrument breaks
down the application, it creates a powerlessness report and hazard evaluation and presents this
report to the verifying application framework.
5.4 Mobile Application Approval or Rejection
The application endorsement/dismissal procedure starts after a defenselessness and hazard report
is produced by a test device and made accessible to at least one security examiners. A security
investigator (or examiner) investigates helplessness reports and hazard evaluations from at least
one test apparatuses to guarantee that an application meets all broad application security

INVESTIGATION INTO SECURITY OF MOBILE APPS 22
prerequisites. An investigator will as well assess organization-specific application security
necessities to decide whether an application disregards any security strategies or guidelines.
Subsequent to assessing all broad and association explicit application security prerequisites, an
examiner will order this data into a report that indicates a proposal for supporting or on the other
hand dismissing the application for arrangement on the association's cell phones.
The proposal report from an expert is then made accessible to an approving authority, who is a
senior authority of the association in charge of figuring out which applications will be conveyed
on the association's cell phones. An approving authority chooses the endorsement or dismissal of
an application utilizing the proposals given by the investigators and thinks about other
association explicit (non-security-related) criteria including cost, need, and so on. The expert
may include potential moderating controls for certain discoveries, for example, the utilization of
a for each application Virtual Private
System (VPN) to ensure the information in travel. When making the application assurance, the
approving authority considers these alleviations too the affectability of information created or
gotten to by the application, the sort of clients and how the application will be utilized, who
possesses and deals with the gadget and regardless of whether the application will access back-
end frameworks or information (see Step 1of the Risk Management Structure. These examiner
reports depict the application's security act just as conceivably other non-security-related
prerequisites. The association's authentic endorsement or dismissal is indicated in a last
endorsement/dismissal report. The figure below demonstrates the application
endorsement/dismissal process.

INVESTIGATION INTO SECURITY OF MOBILE APPS 23
Mobile Application System Approval/Rejection
5.5 Risks and threats model
Risk management is a precise procedure created by Microsoft Corporation that starts with a
reasonable comprehension of the framework or an application. It is important to characterize the
accompanying regions to comprehend potential dangers to the application as appeared in figure
a) Mobile Application Architecture: This region depicts how the application engineering is
structured from gadget explicit highlights and functionalities utilized by the application, remote
and information transmission conventions, information transmission mediums, cooperation with
equipment segments and different uses of the association.

INVESTIGATION INTO SECURITY OF MOBILE APPS 24
b) Mobile Data: What sort of information do the mobile application store and procedure? What is
the business motivation behind this information and what are the information work processes and
so forth.
c) Threat Agent Identification: What are the dangers (or levels) to the versatile application and
who are the risk operators. This zone additionally diagrams the procedure for characterizing what
dangers apply to the versatile application, for example, section and leave purposes of the
application.
d) Methods of Attack: What are the most widely recognized assaults used by various danger
specialists. This zone characterizes these assaults with the goal that application or server controls
can be created to relieve assaults.
e) Controls: What are the diverse application and server controls to avert assaults? This is the last
region to be characterized simply after past regions have been finished by the application
improvement group.

INVESTIGATION INTO SECURITY OF MOBILE APPS 25
How Attackers Hack into our Mobile Devices
5.6 Results Analysis
Correspondence includes sharing outcomes crosswise over application reviewing groups to
diminish re-work; it happens when a government organization's application screening procedure
use results from another office that has beforehand performed application reviewing on the
equivalent application. It empowers the getting organization to reuse the application testing
results when making their own hazard assurance on the organization of the application. To share
the security checking results, the testing organization catches the consequences of application
security testing against a regular arrangement of security necessities (e.g., NIAP) in an
institutionalized correspondence report position, with the goal to make the data accessible for use
by different offices.

INVESTIGATION INTO SECURITY OF MOBILE APPS 26
Given the diverse potential uses any individual application may have and distinctive mobile
structures between various offices, sharing danger choices (endorsement/dismissal) isn't
suggested. The option is to make discoveries from tests directed by one government organization
accessible to other government offices, enabling offices to make their very own hazard-based
conclusions without having to rehash tests previously directed by different organizations. This
sharing of an association's discoveries for an application can incredibly diminish the duplication
and cost of an application confirming endeavours for different associations.
Data sharing inside the product confirmation network is fundamental and can help test devices
advantage from the aggregate endeavours of security experts around the globe. The National
Weakness Database (NVD) is the U.S. government archive of norms based weakness the
executives’ information spoke to utilizing the Security Content Automation Protocol (SCAP).
This information empowers the computerization of powerlessness the executives, security
estimation, what's more, consistency. The NVD incorporates databases of security agendas,
security-related programming imperfections, misconfigurations, item names, and effect
measurements. SCAP is a suite of particulars that institutionalize the configuration and
classification by which security programming items impart
5.7 Tools and Services used
There are numerous apparatuses and administrations devoted to dissecting versatile applications.
Contingent upon the model utilized by the instrument/specialist organization, application
investigation may happen in various physical areas. For instance, an investigation device might
be introduced and keep running inside the system of the association for whom the application is
expected. Different merchants may have their test administrations offsite.

INVESTIGATION INTO SECURITY OF MOBILE APPS 27
Offsite devices may live on the reason of the instrument/specialist organization or may live in a
cloud foundation. Every one of these situations ought to be comprehended by an association
preceding utilizing a confirming device/administration, particularly in those situations where the
codebase of the application may contain touchy or grouped data.
6.0 Discussion
6.1.0 Source Code Testing
A primary consideration in performing application testing is whether source code is accessible.
Commonly, applications downloaded from an application store don't accompany access to source
code. At the point when source code is accessible, for example, on account of an open-source
application, an assortment of apparatuses can be utilized to examine it.
The objectives of a source code survey are to discover vulnerabilities in the source code and to
confirm the aftereffects of test apparatuses. Indeed, even with computerized help, the
examination is work concentrated. Advantages of utilizing robotized static investigation
apparatuses incorporate presenting consistency between various audits and making potential
surveys of huge codebases. Commentators ought to by and large use computerized static
investigation apparatuses whether they are directing a computerized or a manual audit and they
ought to express their discoveries as far as Common Weakness Enumeration (CWE) identifiers
or a few other generally acknowledged terminology. Playing out a safe code audit requires
programming improvement and space explicit learning in the zone of application security.
Associations ought to guarantee the people performing source code audits have the necessary
abilities and skill.

INVESTIGATION INTO SECURITY OF MOBILE APPS 28
Associations that plan to create applications in-house likewise ought to allude to the direction on
secure programming procedures and programming quality affirmation procedures to fittingly
address the whole programming improvement lifecycle.
At the point when an application's source code isn't accessible, its twofold code can be examined.
In the setting of applications, the expression "paired code" can allude to either byte-code or
machine code. For model, Android applications are arranged to byte code that is executed on a
virtual machine, comparative to the Java Virtual Machine (JVM), however, they can likewise
accompany custom libraries that are given as machine code, i.e., code executed straightforwardly
on a cell phone's CPU. Android paired applications incorporate byte-code that can be examined
without equipment bolster utilizing imitated and virtual conditions.
6.2.0 Correctness Testing Method
One methodology for testing an application is programming rightness testing [18]. Programming
accuracy testing is the way toward executing a program to identify blunders. Despite the fact that
the goal of programming rightness testing is improving quality confirmation just as checking and
approving portrayed usefulness or evaluating unwavering quality, it additionally can help
uncover potential security vulnerabilities that frequently can negatively affect the quality,
usefulness and dependability of the product. For model, programming that accidents or displays
unforeseen conduct is frequently demonstrative of a security defect. A favorable prime position
of programming rightness testing is that it is customarily founded on details of the product to be
tried. These particulars can be changed into necessities that determine how the product is
required to carry on while experiencing testing. This is recognized from security appraisal
approaches that frequently require the analyzer to determine prerequisites themselves; regularly
such necessities are to a great extent dependent on security prerequisites that are basic crosswise

INVESTIGATION INTO SECURITY OF MOBILE APPS 29
over a wide range of programming antiquities and may not test for vulnerabilities that are one of
a kind to the product under test. In any case, as a result of the tight coupling between security
furthermore, quality, and usefulness and unwavering quality, it is prescribed that product
rightness testing be performed when conceivable.
6.2.0 Managing and Un-mapping Mobile Applications
Undertaking applications, or outsider applications conveyed on big business gadgets (or
individual gadgets utilized for big business assignments), might be overseen all through the
organization lifecycle, from starting organization and design through the expulsion of the
application from a gadget. Overseeing such oversaw applications can be performed utilizing
undertaking Mobile Application Management (MAM) frameworks which are intended to
empower undertaking command over versatile applications that get to big business
administrations as well as information. Unmanaged (individual use) applications will be
applications that are not managed by MAM (or comparative) frameworks.
One advantage of overseeing just applications (instead of the whole gadget) is that MAM
frameworks don't require the client/proprietor to select the whole gadget under big business the
executives, nor must the proprietor acknowledge the establishment of an endeavor profile on the
gadget. MAM arrangements can empower an endeavor to coordinate an in-house venture
applications list with a cell phone merchant's App Store (e.g., Apple's App Store, Google Play, or
the Microsoft Store) to permit versatile clients to introduce a venture application effectively.
Undertaking framework directors might have the option to convey applications or push out over-
the-air application updates to versatile clients; they may likewise have the option to limit
application functionalities without influencing the whole gadget, which might be favored by
Bring Your Own Device (BYOD) clients. Some Mobile Device Management (MDM)

INVESTIGATION INTO SECURITY OF MOBILE APPS 30
frameworks to incorporate MAM usefulness, empowering fine-grained authority over various
applications on a solitary overseen gadget. MDM and MAM highlights can be utilized to confine
the progression of big business information among oversaw and unmanaged applications.
A venture ought to think about the tradeoffs among oversaw and unmanaged applications when
structuring its versatility arrangements, prerequisites, and strategies for overseeing mobile
applications (instances of such security prerequisites can be found in the DoD Chief Information
Officer reminder on "versatile Application Security Requirements." Tradeoffs may incorporate
the authoritative overhead and additional expense versus the security assurances gotten by
permitting as it was overseen applications on cell phones that entrance venture systems and
administrations.
6.3.0 Limitation of Approving or Rejecting the Mobile Apps
Likewise, with any product affirmation process, there is no assurance that even the most careful
screening procedure will reveal every single potential weakness or pernicious conduct.
Associations ought to be made mindful that in spite of the fact that application security
appraisals, by and large, improve the security stance of the association, how much they do so
may not be effectively or right away discovered. Associations ought to likewise be made mindful
of what the checking procedure does and does not give regarding security.
Associations ought to likewise be taught on the estimation of people in security evaluation forms
also, guarantee that their application screening doesn't depend exclusively on robotized tests.
Security examination is fundamentally a human-driven procedure; robotized instruments
independent from anyone else can't address numerous of the logical and nuanced
interdependencies that underlie programming security. The most evident purpose behind this is
completely understanding programming conduct is one of the works of art unimaginable issues

INVESTIGATION INTO SECURITY OF MOBILE APPS 31
of software engineering, and truth be told, current innovation has not even arrived at the points of
confinement of what is hypothetically conceivable. Unpredictable, multifaceted programming
models can't be completely broken down via mechanized methods.
Also, current programming investigation apparatuses don't intrinsically comprehend what
programming needs to do to carry on in a protected way in a specific setting. For instance, the
inability to scramble information transmitted to the cloud may not be a security issue if the
transmission is burrowed through a virtual private system (VPN). Regardless of whether the
security necessities for an application have been accurately anticipated and are totally
comprehended, there is no present innovation for unambiguously making an interpretation of
intelligible necessities into a structure that can be comprehended by machines.
Hence, security examination requires human experts are tuned in, and by augmentation, the
nature of the result depends, in addition to other things, on the degree of human exertion and
aptitude accessible for assessment. Examiners ought to be comfortable with standard procedures
and best rehearses for programming security appraisal. So as to be fruitful, a powerful
application verifying procedure should utilize a tool kit approach where various evaluation
instruments and procedures, as well as human connection, cooperate. Dependence on just a
solitary instrument, even with human cooperation, is a huge hazard in view of the intrinsic
constraints of each device
7.0 Reflection of the research
This research was carried out successfully by the team members. The research was done by a
team which were sub-grouped into four groups. Each group was assigned the task to look into so
that the work can be completed within the timeline. Four individuals were grouped together so
that they can handle a certain broken task together.

INVESTIGATION INTO SECURITY OF MOBILE APPS 32
Risk tolerance should take into account the following factors:
 Compliance with security regulations, recommendations and best practices;
 Privacy risks;
 Security threats;
 Data and asset value;
 Industry and competitive pressure; and
 Management preferences.
Like all normal application software, mobile applications systems regularly contain
vulnerabilities (presented by blunders in structure or execution or by noxious expectation) that
can uncover a client, cell phone and its information or venture administrations or its information
to assaults. There are various regular classes of mobile programming mistakes that can make
such vulnerabilities, incorporating blunders in the utilization or execution of cryptographic
natives and other security administrations, unsafe connections among programming segments on
a cell phone, and unsafe communications between the cell phone and frameworks inside its
condition. Basic mistakes in utilizing security administrations or cryptography incorporate
powerless validation of clients or frameworks, off base usage of cryptographic natives, picking
obsolete or broken cryptographic calculations or parameters, or inability to encode application
traffic between a cell phone and web-or endeavor facilitated administrations. Unsafe
communications among programming parts on a cell phone incorporate the utilization of
information from dishonest sources as a contribution to security-touchy activities, utilization of
helpless outsider gave programming libraries, what's more, application code that releases touchy
information outside of the application (e.g., through logs of application action). Moreover,

INVESTIGATION INTO SECURITY OF MOBILE APPS 33
mobile frameworks might be presented to malignant code or infusions of information through
correspondence with a traded off web or venture administration.
Confirming mobile applications before sending them onto a client's cell phone can empower a
venture framework director to recognize programming or arrangement blemishes that may make
vulnerabilities or abuse venture security or protection strategies. Versatile application checking
frameworks commonly incorporate computerized testing and examination apparatuses and may
associate with remotely facilitated reviewing administrations. This segment will talk about
various classes of malware that influence cell phones. Versatile application reviewing
frameworks are intended to search for proof of such malware.
It is essential to perceive the continually moving assault scene while considering the following
classes of versatile application dangers. This rundown isn't proposed to be comprehensive, nor
should it be taken a convincing or potentially prescriptive rubric to assess the quality of a
screening arrangement, enactment, or security act. Or maybe, it is proposed to be an illustrative
rundown of right now watched dangers.
Risks and threats are the parts well-articulated in this report. While carrying out the research
project, we were able to go deeply into the possible threats which have caused a lot of problems
to our mobile application systems.
An endeavor cell phone trying to utilize an application may do as such in a few different ways.
The undertaking may have a particular application store that just contains confirmed
applications. Then again, the gadget may have arrangement guidelines implemented by a venture
portability the executives (EMM) framework that manages what applications might be
introduced from any source. These frameworks are spoken to by the case in the upper left corner

INVESTIGATION INTO SECURITY OF MOBILE APPS 34
of the outline. Data about the mentioned application (for the most part application twofold code,
be that as it may, here and there application source code for applications created "in house") is
sent from this framework to the application confirming coordination center to start the
application screening process
Conclusion
The investigation concentrated on the significant security and protection concerns related to the
utilization of mobile applications security threats and breaches. Despite the fact that a few
application users and vendors give terms of utilization and protection arrangements when
downloading the application, there isn't yet a satisfactory method to furnish level of security
difficulties related with and security dangers that exist in mobile applications systems to clients.
Likewise, it is here and there not clear what information is gathered, how information is
overseen, and who approaches them. By utilizing the scientific classification model,
investigation of 50 applications unveils that huge numbers of mobile applications have security
challenges and are vulnerable to security threats and attacks. There are two viable ramifications
of the outcomes. In the first place, designers of mobile applications systems should figure out
how to show what and degree of the security and the security issues that exist on the mobile
system applications and the related attacks. Second, clients ought to know about what and degree
of the security and protection dangers, and dangers related to utilizing the mobile mobile
applications systems on our information system. Future studies will concentrate on investigating
if there is variety in the significance of the security dangers and security complexity of mobile
applications systems by classes of the investigated mobile apps, and by the stages on which the
applications are running on.

INVESTIGATION INTO SECURITY OF MOBILE APPS 35
The trouble with verifying anything from burglary or devastation is that countermeasures are
reactions to dangers. We can make expectations, in view of understanding or taught surmises,
about what will be focused on and how, yet without knowing the aim of cyber criminals it is hard
to be completely mindful of and safeguard against every one of them. In light of the SOPHOS
report, and the many IS security experts who have given their archived feelings, I feel focused on
assaults against the businesses of fund, medicinal services and basic foundation by the utilization
of Advanced Persistent Threat (APT) is the most exasperating. Assault strategies that have
higher profiles or are planned for solitary assaults can cause long haul pulverization, much like
being assaulted by a wild creature. APTs are "naturally" expected to stay covered up, persistently
taking, tainting information, spreading and causing devastation, similar to an inconspicuous
malignancy. Security from a tricky warning will require being alarm and prepared to react on
numerous levels, so a Defense in Depth approach is the best choice.
With the capacity of cybercriminals to adjust their weapons to assault their objectives, something
will consistently get past. With respect to location and reaction is the way to limiting the effect,
so hence I recommend a solid spotlight on checking system traffic by those that realize the
stream designs and can research and precisely recognize variations from the norm so reaction
group can intercede when required. To this, I would propose procuring a security seller to help
with hailing traffic as an additional layer.
Cybercriminals, similar to some other kind, will keep on exploiting individuals, associations and
anything they feel misuse, with old and new assaults. To battle this, objectives and unfortunate
casualties must be in any event as forceful with all due respect. Like in a fighting, arrangement
and counteractive action limits presentation to assaults, yet a fruitful safeguard depends on early
discovery and quick reaction. Security isn't only for huge companies or governments. In the

INVESTIGATION INTO SECURITY OF MOBILE APPS 36
present time of registering advances, frequently in our own hands, we hold gadgets that can be
utilized to incur a great deal of harm. Security is an obligation of every one of us.
References
Abraham, A., & Dalziel, H. Automated security analysis of Android and iOS applications with
mobile security framework.
Abraham, A., & Dalziel, H. Automated security analysis of Android and iOS applications with
mobile security framework.
Chandra, P. (2009). Wireless security. Burlington, MA: Newnes.
Bessis, J. (2015). Risk Management in Banking. New York, NY: John Wiley & Sons.
Essvale Corp. (2009). Business knowledge for IT in insurance. London.
Chorafas, D. (2007). Risk management technology in financial services. Burlington, MA:
Elsevier/Butterworth-Heinemann.
Guo, G., & Wechsler, H. Mobile biometrics.
Joseph, C. (2013). Advanced credit risk analysis and management. Chichester, West Sussex:
John Wiley & Sons Inc.
Hulett, D. (2013). Integrated cost-schedule risk analysis. Farnham: Gower.
Klijn, F., Schweckendiek, T., Klijn, F., & Schweckendiek, T. (2013). Comprehensive flood risk
management. Boca Raton, FL: CRC Press.
Hoog, A. (2011). Android forensics. Waltham, MA: Syngress.

INVESTIGATION INTO SECURITY OF MOBILE APPS 37
Labbi, A. (2005). Handbook of integrated risk management for e-business. Boca Raton, Fla.: J.
Ross Pub.
Makan, K. (2013). Android Security Cookbook. Packt Publishing.
Merna, T., & Al-Thani, F. (2011). Corporate Risk Management. Hoboken: John Wiley & Sons,
Ltd.
Velu, V. (2016). Mobile application penetration testing. Birmingham, UK: Packt Publishing.
Mukherjea, S. Mobile application development, usability, and security.
Thuraisingham, B. (2001). Data and applications security. Boston: Kluwer.
Raczkowski, K. (2017). Risk Management in Public Administration. Cham: Springer
International Publishing.
Wang, J., & Lau, R. Advances in web-based learning ICWL 2013.
Siegrist, M., Earle, T., & Gutscher, H. (2010). Trust in risk management. London: Earthscan.