PRESENTERS: AMOL KOKJE, STEVEN OSBURN, SUNIT VERMA, TOSHA SHAH, KALP PARIKH Vetting Mobile Apps

Need for Vetting Hardcoded passwords Web browser vulnerabilities Language used Use of third party apps/libraries

Vetting Apps Security – CWE has a list of possible Software weaknesses/errors. Analysis – Static (App source code), Dynamic (test data), Questionnaire (DHS Questionnaire) Analysis Tools App Submission and Reporting – Mechanisms, Infrastructure Human Analysis – e.g. vetting false positives

Important Conclusions Well the testing can not be restricted to only one kind of tool/method. For example of a mobile app using open CV libraries as we all know its third party apps you need to test black box testing and for the functionality of source code we need to have white box testing.

Questions from Audience Burden of Security on user. For most of apps from example Remote Desktop by Google Chrome it solely depends on user to allow personal data as public data in order to use the app. So the security is a shared concern between company publishing app and user what all data they need to make public in order to use specific services.