Mobile Testing Framework
Linux
Python
Ruby
Bash
Java
Theos/Logos
SQLite
CLI
This project was a Mobile Application Security Testing (MAST) framework that provided coverage for vulnerabilities spanning the entire OWASP Mobile Top 10, and supported both Android and iOS Application Security Testing. Application assessments could be run against mobile applications and perform a number of automated vulnerability checks. In addition, there were tools built in to the framework that a security analyst could run as-needed to assist with the testing process. These are tools like the FileDP replacement, which is described above.
Finally, the testing framework allowed for custom reporting, and for assessment results to be uploaded to a customer portal for delivery. This allowed for Mobile AST results to reside in the same portal (and with the same format) as testing results from other Application Security tools.
This tool was developed in direct response to a number of challenges that are common in MAST testing practices:
- Mobile Testing is a highly manual process, and therefore both very expensive and subject to inconsistency when subsequent tests were performed by different security experts.
- There was often a very large amount of data to traverse, which is best performed programmatically
- There was no standardised vulnerability enumeration or reporting
This tool was written in several languages, with primary development done in Ruby, Bash, C, and Java. There were also components (primarily application hooking) written using Theos/Logos. It was delivered initially as an iOS-specific testing tool and, after success with iOS testing, an Android version was created. Due to the differences between iOS and Android, the tests performed had completely different implementations on each platform, and in several cases, there were OS-specific tests performed. These would be things like Android manifest checks, or jailbreak detection bypass in iOS.
Information Security Issue Validation Platform
Python
Flask
Docker / docker-compose
Web
MySQL
Javascript
Javascript
REST API
This project was a web application to consolidate information about observed security risks and issues from multiple sources into a single platform that allowed the Application Security team to perform further testing and analysis quickly and open Jira issues directly from the application interface when necessary. Additionally, a Chrome extension was developed to further assist Application Security Engineers with credential testing during Threat Modelling Exercises.
Business Intelligence Platform
Web
Next.JS
Node.js
D3.js
MongoDB
Python
REST API
This project was a business analytics platform that ingested data from sources across an enterprise Information Security organization and used it to communicate the status of InfoSec Programs, Projects, and Portfolios in a Single Pane of Glass (SPOG) web application. This information combined high-level project information (status, timeline, milestones), finance information (budget, spend, utilisation), and project-specific information (issue discovery, resolution, state, status distribution) to present information that empowered leadership to make decisions on budget allocation, project efficacy, and progress toward stated project goals.
FileDP Replacement
C
Linux
Internal replacement of FileDP, a tool for data protection class validation on iOS. This tool allowed for easy tracking and parsing of application data privileges on a device. This was a standalone component that could be used by itself, or integrated into the Mobile Testing Framework project.
This tool was developed to address challenges with FileDP that prevented use in an automated framework. The primary changes were to:
- Output information as text instead of NSLog, which allows results to be easily grep-able
- Optionally allow for XML->plist output, which allowed for seamless use of results in internal framework, and importing into another application