mobile Audit v3.0 releases: performs SAST and Malware Analysis for Android APKs

Mobile Audit

MobileAudit – SAST and Malware Analysis for Android Mobile APKs

Django Web application for performing Static Analysis and detecting malware in Android APKs.

In each of the scans, it would have the following information:

• Application Info
• Security Info
• Components
• SAST Findings
• Best Practices Implemented
• Virus Total Info
• Certificate Info
• Strings
• Databases
• Files

Main features

• Uses Docker for easy deployment in a multiplatform environment
•  Extract all information of the APK
•  Analyze all the source code searching for weaknesses
• All findings are categorized and follow CWE standards
•  All findings are categorized and include Mobile Top 10 Risk
• Also, highlight the Best Practices in Secure Android Implementation in the APK
•  The findings can be edited and the false positives can be triaged and deleted
•  All scan results can be exported to PDF
•  User authentication and user management
•  API v1 with Swagger and ReDoc
•  TLS
•  Dynamic page reload (WIP)
•  LDAP integration
•  Export to Markdown
•  Export to CSV

Patterns

The application has an engine with different rules and patterns that are used through the findings scanning phase to detect vulnerabilities and/or malicious code into the apk.

These can be activated and deactivated in /patterns

Note: some of the hardcoded patterns are from apkleaks

Models

The application has a created models for each of the entities of the scans’ information to be able to create relations and obtain the best conclusions for each of the apks.

To see the whole model schema, go-to models

### Integrations

Virus Total (API v3)

It checks if there has been a scan of the APK and extracts all its information. Also, there is the possibility of uploading the APK as selected a property in the environment (Disabled by default).

Defect Dojo (API v2)

It is possible to upload the findings to the defect manager.

MalwareDB & Maltrail

It checks in the database if there are URLs in the APK that are related to Malware.

Changelog v3.0

• Upgrade python to 3.9.16
• Upgrade nginx to 1.23.3
• Upgrade rabbitmq to 3.11.5
• Upgrade postgres to 15.1
  Note: Previous postgres data is not compatible with the new version, so to be able to run the new version, the docker volumes must be removed and recreated:
  docker compose down
docker volume list
docker volume rm <volumename>
docker compose up
  In case you care about the data, use pg_dumpall to dump you data before removing the files and restore after you run docker-compose up

Install & Use

Copyright (C) 2021 mpast