Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am interested in performing a penetration test of a Windows Phone 8 application for which I do not have the source code. While I can easily validate network communication security, it is more difficult to validate that the application is not storing any sensitive data insecurely.

Because there is no public jailbreak/root for Windows Phone 8 at this time, this seems to be a difficult task.

I considered that if I could install the app into the Windows Phone 8 emulator/simulator that I could use WinDbg, Process Hacker, maybe Process Monitor, or even API Monitor to determine where files are being written/read in the simulator's file system.

My purpose is to ensure a Windows Phone 8 application enforces security as this application claims, and it is difficult to perform a penetration test without root/SYSTEM access to the device.

Is it possible to monitor a Windows Phone 8 app's filesystem activity either in the simulator or on a device (without the app's source)? If so, how?

share|improve this question
    
More comments here: ReverseEngineering StackExchange –  Mick May 13 '13 at 13:23
add comment

1 Answer

up vote 2 down vote accepted

I believe it is possible to jailbreak a windows 8 phone. Seeing as Microsoft can't keep people from pirating games for the XBOX 360, I don't expect Microsoft to be able to put up much of a fight in the jailbreak war.

A jailbroken device isn't the only way to conduct analysis of a mobile app. You can decompile Windows 8 apps which can shed light in their inner workings. As with iOS and Android hacking, you can MITM SSL/TLS connections by importing an your own certificate and intercept requests using a program like BURP.

share|improve this answer
    
I assumed Windows Phone 8 OS was different than Windows RT...am I incorrect? –  Mick May 5 '13 at 0:18
1  
@Mick Grove I think it comes in two flavors depending if its an ARM or x86 system, but the link is to a project that is dedicated to windows 8 jailbreaks. –  Rook May 5 '13 at 0:30
    
I have a Nokia Lumia 920 and having looked at the jailbreak listed on XDA, it does not appear to work on this device. –  Mick May 6 '13 at 16:12
    
@Ramhound I am not a Windows 8 expert. However, I believe Windows RT can run these same apps. If you want to perform analysis on the app it doesn't matter if you jailbreak your phone, its just having any device with this level of access. –  Rook May 6 '13 at 16:34
1  
@Rook - You are the one who is being rude to another user. I was only trying to inform you there is a difference between Windows Phone 8 and Windows RT applications. You even admit you are not a Windows 8 expert. –  Ramhound May 7 '13 at 16:41
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.