Silent data leaks
Location, contacts, clipboard or credentials sent to third-party servers.
The context
Why audit before publishing
Stores ask publishers to declare their privacy practices, but these declarations are filled in by the publishers themselves. An application can therefore be published without its data transfers, to third-party servers for example, ever being checked.
Looking at declared permissions is not enough: a granted permission says nothing about how it is used. Analysing what the application is programmed to do reveals the actual processing and its recipients.
On the enterprise side, distributing applications through an MDM or an internal store engages the organization's responsibility. If the application transmits data in an uncontrolled way, the organization is accountable, whether it built it or not.
A complete audit covers three points: behaviours and data processing, the security of network communications, and code vulnerabilities, including those of embedded libraries.
The solution
How Pradeo audits your applications
Pradeo's Mobile Application Security Testing solution analyses the mobile application's binary code, with no access to its source code. It identifies its behaviours, network flows and vulnerabilities, referenced against OWASP and US-CERT. Android and iOS are covered by the same platform.
The security policy is fully customizable, so the report only surfaces what matters in your sector. Audits run from the online platform, or via API to plug into your CI/CD pipeline: every new build is analyzed automatically before release, with no manual step for developers.