Revision a8a95432-0401-4d8a-a89e-0f939ddb023a - Information Security Stack Exchange

 1. There are vulnerable mobile apps that one can run in an emulator,
    simulator, or on device. (*)
 2. There is a testing ground for smart grid and industrial controls
        systems which includes an RF test ground component. It's called
        [SamuraiSTFU][1], a nameplay on the original [SamuraiWTF][2] guest VM for testing vulnerable web applications. I think WTF stands for Web Testing Framework while STFU stands for Security Testing For Utilities (i.e., smart grids and control engineering systems). (**)
 3. I agree that there should be a guest VM to practice the full mobile
    stack including carrier technology such as 3G and LTE, however this
    is a gap that can be filled. Start a project to do it yourself!

----------

  (*) A short list of available apps include iGoat, "Damn Vulnerable" apps of other kinds, the [Exploit-Me][3] labs from Security Compass, and most importantly the amazing work behind [OWASP GoatDroid][4] and the [Sieve APK][5] app intended to be a testing ground for the Drozer mobile attack framework. Ideally, a person interested in the security footprint of the mobile space would utilize a variety of open source apps (available by searching the Internet) or by building their own apps that expose the full functionality of the vendor SDKs.

(**) The particular components in SamuraiSTFU that cover RF technology generally focus on technologies that are not specifically 3G or LTE. Thus, I might recommend instead that you check out a variety of other resources including a book that came out last week called "Getting Started with OpenBTS" (O'Reilly Press) which mentions the Ettus Research and other GSM network hardware/software that can run production, but amateur, carrier-like networks.

Other important titles include: "Hacking and Securing iOS Applications", "Bulletproof Android: Practical Advice for Building Secure Apps", "Android Security Internals", "Mac OS X and iOS Internals: To the Apple's Core", "Android Security Cookbook" -- as well as a few titles that you may or may not be able to get early access to: "The Mobile Application Hacker's Handbook" and "iOS Application Security: The Definitive Guide for Hackers and Developers", but that will be out soon available from bookstores such as Amazon or services such as SafariBooksOnline or Books24x7. There are a few books that I left out of this list because there are quite a lot and perhaps too numerous to list right here right now.


----------


Just as an aside, I do a lot of mobile and payment (e.g., digital wallet) testing for my full-time job, about 8 years in these specific industries. So I've been [penetration testing mobile devices and platforms][6] since the original iPhone was released. I have had a keen interest in [NFC technology][7], especially Secure Element and TEE sub technologies involved in the mobile payment space directly (the Android Internals book mentioned above touches on these a little bit).

For a more complete set of resources covering 3G and earlier technologies in terms of security issues one would expect to hear about as exploitable from a penetration testing perspective, be sure to check out all of these:

* http://www.zjulian.com/look-at-that-backend

* http://events.ccc.de/congress/2014/Fahrplan/events/6531.html

* http://events.ccc.de/congress/2014/Fahrplan/events/6122.html

* http://events.ccc.de/congress/2011/Fahrplan/events/4663.en.html

* http://events.ccc.de/congress/2010/Fahrplan/events/4090.en.html

* http://events.ccc.de/congress/2010/Fahrplan/events/4151.en.html

* http://events.ccc.de/congress/2009/Fahrplan/events/3555.en.html

* http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html

* http://events.ccc.de/congress/2008/Fahrplan/events/2997.en.html

* http://events.ccc.de/congress/2002/fahrplan/event/495.en.html

* http://media.ccc.de/browse/congress/2014/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel.html#video

* http://blog.ptsecurity.com/search/label/telecom


  [1]: http://www.samuraistfu.org
  [2]: http://www.samurai-wtf.org
  [3]: http://labs.securitycompass.com/exploit-me/
  [4]: https://www.owasp.org/index.php/Projects/OWASP_GoatDroid_Project
  [5]: http://mwr.to/sieve
  [6]: https://security.stackexchange.com/questions/10000/ios-android-pen-test/
  [7]: http://dangerousprototypes.com/2012/12/23/defcon-20-nfc-hacking-the-easy-way/