Secure mobile development 1: storage, cryptography, authentication and network
You apply the first four areas of OWASP MASVS-style requirements: storing data safely, using cryptography correctly, getting sessions and biometrics right and protecting network traffic.
Level 201 · 22 lessons · 18 practice labs
Lessons
Requirements
- Mobile app security requirements: a look at OWASP MASVS
- From requirement to test: writing verifiable security items
- Classifying the data in an app
- Short task: write ten security requirements for an ordering app
Storage
- Safe storage: internal space, external space and cache
- Encrypted preferences and an encrypted database
- Using the Keystore: generating keys and binding them to user authentication
- Backup rules: allowBackup and data extraction rules
- Leak channels: logs, clipboard, screenshots, keyboard cache
- Short task: move code that stores a token in plaintext to Keystore-backed storage
Cryptography
- Choosing the right primitives: AES-GCM, key derivation, randomness
- Common mistakes: hard-coded keys, ECB mode, fixed IVs
- Short task: find the code that encrypts with a hard-coded key and fix it
Authentication and sessions
- Login and sessions: token lifetime, refresh and logout
- Biometric authentication: key-bound and unbound use
- In-app PIN and local lock
- Short task: bind a biometric check that only looks at the success callback to a key
Network
- TLS and the network security configuration
- Cleartext traffic and debug-only overrides
- Certificate pinning: when, how and backup pins
- Short task: close a configuration that allows cleartext traffic and verify it
Capstone
- Capstone: close a wallet app's weaknesses in all four areas and prove it with tests
Practice labs
- Write five requirements for an ordering app: Write five testable security requirements covering storage and network.
- Make vague requirements testable: Turn six items like "data is stored securely" into measurable items with a verification method.
- Classify app data and tie it to requirements: Classify the data fields of the Lavinya Klinikleri appointment app and write a requirement tied to a MASVS item for each class.
- Move a file written to external storage into internal space: Move code that writes an invoice to a shared folder into app-private space and update its test.
- Move a token to Keystore-backed storage: Move a class that keeps the token in plaintext to encrypted preferences and test that the old value is deleted.
- Keep sensitive files out with backup rules: Write data extraction rules that exclude the session and database files and verify the rule file with a static check.
- Find the line that uses ECB mode: Find the call using an insecure cipher mode in the project and say why it is weak.
- Fix code that encrypts with a hard-coded key: Replace the constant key with one generated in the Keystore and pass the encryption tests.
- Remove a fixed IV and weak derivation together: Use a random IV each time with AES-GCM, move password derivation to an iterated function and show by test that two ciphertexts differ.
- Show that the token is not cleared on logout: Examine the logout function, prove by test that the local token remains and fix it.
- Bind the biometric check to a key: Turn code that looks only at the success callback into a flow that decrypts with an authentication-bound key.
- Add an attempt limit to the in-app PIN: Fix a module that stores the PIN plainly and allows unlimited tries, using a derived value and growing delay, and test it.
- Close the setting that allows cleartext traffic: Remove the cleartext permission from the manifest and network configuration and verify with a static check.
- Fix a release that trusts user certificates: Move user-certificate trust to the debug build only and compare the configuration of the two builds.
- Write a pinning configuration with a backup pin: Derive a pin from the lab server's certificate, add a backup pin and expiry and verify the configuration with a script.
- Pull one finding per area from a wallet app: Find and list one weakness each in storage, crypto, session and network in the training project.
- Map findings to requirements and prioritise: Map eight findings to MASVS items and write the fix order with reasons.
- Close two weaknesses and prove it with tests: Fix the token storage and certificate trust mistakes in the wallet project and add a regression test for each.
About this course
You apply the first four areas of OWASP MASVS-style requirements: storing data safely, using cryptography correctly, getting sessions and biometrics right and protecting network traffic.
What you will learn
- Requirements
- Storage
- Cryptography
- Authentication and sessions
- Network
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.