MAS-L2 - Advanced Security
How to proceed when no MASTG TEST exists
The MASTG does not yet provide dedicated tests for every MASWE. Defining a weakness and defining a reliable, reproducible way to test for it are different tasks, and some areas require extensive research, validation, or refinement before they can be captured as formal MASTG TESTs. The guide also evolves continuously as platforms, frameworks, and testing techniques change.
Even when no dedicated MASTG TEST exists, you can still assess the weakness.
-
Start with the MASWE: Review its "Modes of Introduction" to understand the concrete conditions that may introduce the weakness and what should be tested.
-
Check related MASTG content: Look at similar or related existing MASTG TESTs, as they can provide useful testing patterns, structure, and inspiration for designing a new test. Also consult relevant MASTG KNOW, TECH, and TOOL entries, together with the official mobile platform documentation, to understand the topic and identify suitable testing techniques.
-
Contribute back: If you develop a reliable testing procedure, consider contributing a new MASTG TEST and a MASTG DEMO so others can reuse it.
MAS-L2 extends MAS-L1, introducing additional security measures and best practices for mobile apps to address advanced threats requiring more rigorous threat modeling and testing strategies.
It assumes that:
- the security controls of the mobile operating system cannot be trusted (e.g. the device is rooted/jailbroken).
- the primary user of the device is not viewed as an adversary.
- other applications installed on the device are viewed as an adversary.
- a third party with or without physical access is viewed as an adversary.
MAS-L2 is recommended for
- apps that handle high-risk sensitive data and contain sensitive functionality
For example:
- Health care apps that store or process sensitive health or personally identifiable information which could be used for identity theft, fraudulent claims, discrimination, or other forms of abuse. Depending on the jurisdiction and type of application, relevant regulatory and compliance frameworks include the HIPAA Privacy, Security, Breach Notification, and Patient Safety Rules in the US, the European Health Data Space (EHDS) and applicable medical device regulations in the EU, the DiGAV requirements for digital health applications in Germany, and the NHS Digital Technology Assessment Criteria (DTAC) and applicable medical device regulations for software and apps in the UK.
- Financial apps that provide access to sensitive information such as credit card numbers or that let the user move funds. These apps warrant additional controls to prevent fraud and theft, and typically need to demonstrate compliance with standards and regulations such as PCI DSS, the Gramm-Leach-Bliley Act, and the Sarbanes-Oxley Act.
Requirements¶
| Requirement | MASWE ID | Platform | MASVS ID | Tests | Status |
|---|---|---|---|---|---|
| The app encrypts sensitive data stored in private storage. | MASWE-0001: Sensitive Data Stored Unencrypted in Private Storage | MASVS-STORAGE-1 | 11 | ||
| The app encrypts sensitive data stored outside of private storage. | MASWE-0002: Sensitive Data Stored Unencrypted Outside of Private Storage | MASVS-STORAGE-1 | 4 | ||
| The app stores cryptographic keys inside the platform-provided secure keystore. | MASWE-0003: Cryptographic Keys Stored Outside of Platform Keystore | MASVS-STORAGE-1 | 3 | ||
| The app does not hardcode sensitive data in the application package. | MASWE-0004: Sensitive Data Hardcoded in the App Package | MASVS-STORAGE-1 | 0 | ||
| The app excludes sensitive data from application logs. | MASWE-0005: Insertion of Sensitive Data into Logs | MASVS-STORAGE-2 | 4 | ||
| The app excludes sensitive data from backups. | MASWE-0006: Sensitive Data Not Excluded From Backup | MASVS-STORAGE-2 | 4 | ||
| The app properly encrypts sensitive data. | MASWE-0007: Improper Encryption | MASVS-CRYPTO-1 | 10 | ||
| The app properly hashes sensitive data. | MASWE-0008: Improper Hashing | MASVS-CRYPTO-1 | 1 | ||
| The app properly uses Message Authentication Codes (MACs). | MASWE-0009: Improper Use of Message Authentication Code (MAC) | MASVS-CRYPTO-1 | 0 | ||
| The app properly generates cryptographic signatures. | MASWE-0010: Improper Generation of Cryptographic Signatures | MASVS-CRYPTO-1 | 0 | ||
| The app properly verifies cryptographic signatures. | MASWE-0011: Improper Verification of Cryptographic Signature | MASVS-CRYPTO-1 | 0 | ||
| The app properly generates random numbers. | MASWE-0012: Improper Random Number Generation | MASVS-CRYPTO-1 | 4 | ||
| The app securely generates cryptographic keys. | MASWE-0013: Improper Cryptographic Key Generation | MASVS-CRYPTO-2 | 2 | ||
| The app derives cryptographic keys using approved key derivation functions. | MASWE-0014: Improper Cryptographic Key Derivation | MASVS-CRYPTO-2 | 0 | ||
| The app rotates cryptographic keys regularly. | MASWE-0015: Cryptographic Key Rotation Not Implemented | MASVS-CRYPTO-2 | 0 | ||
| The app restricts access to cryptographic keys. | MASWE-0016: Cryptographic Key Access Not Restricted | MASVS-CRYPTO-2 | 0 | ||
| The app verifies that the device has a secure lock configured. | MASWE-0017: Device Secure Lock Not Enforced | MASVS-CRYPTO-2 | 4 | ||
| The app enforces authentication and authorization on its components. | MASWE-0018: Lack of Authentication or Authorization on App Components | MASVS-AUTH-1 | 6 | ||
| The app enables auto-fill support for credential providers. | MASWE-0019: Lack of Auto-fill Support for Credential Providers | MASVS-AUTH-1 | 0 | ||
| The app implements local authentication securely. | MASWE-0020: Local Authentication Can Be Bypassed | MASVS-AUTH-2 | 5 | ||
| The app does not allow fallback to non-biometric credentials for sensitive transactions. | MASWE-0021: Fallback to Non-biometric Credentials Allowed for Sensitive Transactions | MASVS-AUTH-2 | 3 | ||
| The app invalidates keys after any enrollment of new biometric data. | MASWE-0022: Crypto Keys Not Invalidated on New Biometric Enrollment | MASVS-AUTH-2 | 3 | ||
| The app enforces step-up authentication before granting access to sensitive functionality. | MASWE-0023: Step-Up Authentication Not Implemented for Sensitive Actions | MASVS-AUTH-3 | 0 | ||
| The app makes sensitive data inaccessible after session termination. | MASWE-0024: Sensitive Data Accessible After Session Termination | MASVS-AUTH-3 | 0 | ||
| The app ensures non-repudiation for critical actions. | MASWE-0025: Lack of Non-Repudiation for Critical Actions | MASVS-AUTH-3 | 0 | ||
| The app encrypts all network traffic. | MASWE-0026: Network Traffic Not Encrypted | MASVS-NETWORK-1 | 16 | ||
| The app validates certificates for all network traffic. | MASWE-0027: Insecure Certificate Validation | MASVS-NETWORK-1 | 9 | ||
| The app correctly implements identity pinning. | MASWE-0028: Insecure Identity Pinning | MASVS-NETWORK-2 | 4 | ||
| The app securely handles deep links. | MASWE-0029: Insecure Deep Links | MASVS-PLATFORM-1 | 5 | ||
| The app uses the clipboard securely and only with user consent. | MASWE-0030: Improper Use of the Clipboard | MASVS-PLATFORM-1 | 0 | ||
| The app only permits trusted app extensions to interact with it. | MASWE-0031: Allowing Untrusted App Extensions | MASVS-PLATFORM-1 | 1 | ||
| The app securely handles intents. | MASWE-0032: Insecure Intents | MASVS-PLATFORM-1 | 3 | ||
| The app does not expose sensitive native functionality to WebView content. | MASWE-0033: Sensitive Native Functionality Exposed in WebViews | MASVS-PLATFORM-2 | 0 | ||
| The app only allows trusted WebView content to access local resources. | MASWE-0034: WebViews Allow Access to Local Resources with Untrusted Content | MASVS-PLATFORM-2 | 13 | ||
| The app only allows trusted content in WebViews. | MASWE-0035: WebViews Loading Untrusted Content | MASVS-PLATFORM-2 | 5 | ||
| The app does not unnecessarily expose sensitive data through its user interface. | MASWE-0036: Unnecessary Exposure of Sensitive Data via the User Interface | MASVS-PLATFORM-3 | 12 | ||
| The app does not unnecessarily expose sensitive data through system notifications. | MASWE-0037: Unnecessary Exposure of Sensitive Data via Notifications | MASVS-PLATFORM-3 | 1 | ||
| The app removes or masks sensitive data from its views when moved to the background, when being recorded or when a screenshot is taken. | MASWE-0038: Insufficient Protection of Sensitive Data from Screenshots or Screen Recordings | MASVS-PLATFORM-3 | 6 | ||
| The app protects its sensitive screens against overlay attacks. | MASWE-0039: App Vulnerable to Overlay Attacks | MASVS-PLATFORM-3 | 0 | ||
| The app prevents sensitive data from being exposed to, or captured by, accessibility services. | MASWE-0040: Sensitive Data Leaked via Accessibility Services | MASVS-PLATFORM-3 | 1 | ||
| The app detects if it is running on an unsupported OS version and reacts appropriately. | MASWE-0041: Running on a Recent Platform Version Not Ensured | MASVS-CODE-1 | 1 | ||
| The app targets the latest platform version. | MASWE-0042: Latest Platform Version Not Targeted | MASVS-CODE-1 | 0 | ||
| The app detects if it must be updated and reacts appropriately. | MASWE-0043: Enforced Updating Not Implemented | MASVS-CODE-2 | 4 | ||
| The app's third-party components are regularly checked for known vulnerabilities. | MASWE-0044: Dependencies with Known Vulnerabilities | MASVS-CODE-3 | 4 | ||
| The app uses the compiler-provided security features of the platform. | MASWE-0045: Compiler-Provided Security Features Not Used | MASVS-CODE-3 | 5 | ||
| The app does not use deprecated APIs or functionality. | MASWE-0046: Use of Deprecated APIs or Functionality | MASVS-CODE-3 | 0 | ||
| The app uses standard APIs for security-critical functionality. | MASWE-0047: Using Non-Standard APIs for Security-Critical Functionality | MASVS-CODE-3 | 0 | ||
| The app package does not contain malicious code. | MASWE-0048: Malicious Code Included in the App | MASVS-CODE-3 | 0 | ||
| The app loads dynamic code safely from trusted sources. | MASWE-0049: Unsafe Dynamic Code Loading | MASVS-CODE-4 | 0 | ||
| The app securely handles untrusted data. | MASWE-0050: Unsafe Handling of Untrusted Data | MASVS-CODE-4 | 4 |