ENSURING MOBILE APPLICATION SECURITY OF A RENOWNED CREDIT LENDING INSTITUTION FROM SECURITY ATTACKS

CASE STUDY

PENETRATION TESTING FOR SECURITY

One of the leading and oldest Baltimore-based credit lending institutions improves security posture of its mobile application with penetration testing

PENETRATION TESTING FOR SECURITY

One of the leading and oldest Baltimore-based credit lending institutions improves security posture of its mobile application with penetration testing

Problem Statement

The client is an industry veteran in the consumer finance industry providing customers with creative, flexible and convenient lending options.

With its affiliates now featuring over 470 branches in 24 states throughout the country, they are on a path to ensuring they never lose touch with what’s important to them: delivering the most safe and secure customer service to all.

It is with this ‘security first’ quest in mind they turned to Zuci to discover security gaps in their mobile application across the operating systems.

BUSINESS GOALS

Identify vulnerabilities in the mobile app to curtail security attacks from an insider’s and ethical hacker’s eye view

Employ industry standard penetration testing approaches and tools to locate potential areas of exposure

Implement black box testing with Static and Dynamic Analysis on both Android: root privileged & non-rooted application, iOS: Jailbroken & non-Jailbroken to pinpoint security gaps

BUSINESS GOALS

Identify vulnerabilities in the mobile app to curtail security attacks from an insider’s and ethical hacker’s eye view

Employ industry standard penetration testing approaches and tools to locate potential areas of exposure

Implement black box testing with Static and Dynamic Analysis on both Android: root privileged & non-rooted application, iOS: Jailbroken & non-Jailbroken to pinpoint security gaps

HOW ZUCI SYSTEMS HELPED

HOW ZUCI SYSTEMS HELPED

SOLUTION

  • Developed a custom mobile app penetration testing set-up made up of a combination of rooted/non rooted Android devices and jailbroken/non-jailbroken iOS devices
  • Performed in-depth Mobile application assessment based on OWASP – Mobile Application Pentest Framework
  • Identified security vulnerabilities oriented towards business logic flaws, data flows, data leakage, runtime attacks
  • Identified highly impactful vulnerabilities in the mobile app, which was possible after following a custom static and dynamic analysis developed in-house
  • Formal documentation of identified vulnerabilities
  • Walk-through of vulnerabilities to stakeholders

SOLUTION

  • Developed a custom mobile app penetration testing set-up made up of a combination of rooted/non rooted Android devices and jailbroken/non-jailbroken iOS devices
  • Performed in-depth Mobile application assessment based on OWASP – Mobile Application Pentest Framework
  • Identified security vulnerabilities oriented towards business logic flaws, data flows, data leakage, runtime attacks
  • Identified highly impactful vulnerabilities in the mobile app, which was possible after following a custom static and dynamic analysis developed in-house
  • Formal documentation of identified vulnerabilities
  • Walk-through of vulnerabilities to stakeholders

Helped client to fix the critical, high, and medium rated vulnerabilities in priority to deliver secure application to its customers

Identified very critical security vulnerabilities in application, which are already in production and helped client to fix them

BUSINESS OUTCOME

BUSINESS OUTCOME

Helped client to fix the critical, high, and medium rated vulnerabilities in priority to deliver secure application to its customers

Identified very critical security vulnerabilities in application, which are already in production and helped client to fix them

Tech Stack

Tech Stack

STRENGTHEN YOUR MOBILE APP’S SECURITY WITH
PENETRATION TESTING.