Penetration Testing of Connected Car Mobile Apps
Overview
Our esteemed client, one of India’s largest automotive brands with a vast production workforce of over 25,000 people and numerous manufacturing units across Asia, embarked on an innovative journey into the realm of connected cars. Recognizing the potential security risks associated with IoT-based technologies, especially in online operations, the client sought a reliable technology partner to fortify their mobile app against potential hacks. OrangeMantra, with its extensive experience in cybersecurity, emerged as the perfect fit for the task.
Automotive
Cloud & DevOps
Our Process
We started our partnership with a series of requirements gathering workshops that involved key stakeholders. These workshops yielded valuable input for threat modelling. We identified different potential threat agents, vulnerabilities, and exploitation points. We performed both manual and automation tests, to identify loopholes and insecure storage of sensitive data.
To perform app security penetration testing, our team performed two types of attacks. We started with manipulation of the client-server exchange data consisting of credentials and permissions. To keep a check on the man-in-the-middle attack, we tried to intercept the client and server communication. Each testing round has a comprehensive report of identified vulnerabilities, and possible security patch.
Requirements Gathering
OrangeMantra team conducted a series of requirements gathering workshops involving key stakeholders. This helped to gather valuable insights for threat modeling, enabling the identification of potential threat agents.
Threat Modeling
Utilizing the data insights from requirements gathering, OrangeMantra performed an end-to-end threat modeling exercise to understand the potential risks. This laid the foundation for targeted security assessments.
Penetration Testing
To secure the app against potential attacks, testers performed two types of penetration tests. The first focused on manipulating client-server exchange data, while second assessed vulnerability to man-in-the-middle attacks.
Comprehensive Reporting
Each testing round performed a detailed report outlining vulnerabilities and proposed security patches. This detailed reporting facilitated transparent communication with the client, ensuring a clear understanding of potential risks.
