Client background
Our client is one of the world’s most advanced automobile manufacturers and the largest vehicle producer in Europe. With almost 100 production plants worldwide, the company builds cars and offers a broad portfolio of vehicle-related services. Its goal is to deliver attractive, safe, and environmentally sound vehicles that compete in an increasingly tough market and set world standards in their classes.
Business challenge
The client was preparing to launch a new mobile service for individual navigation and for connecting a vehicle to a smartphone. Before the official release, the company needed expert consulting and analysis to confirm that the product met its security requirements and could withstand potential threats to iOS and Android apps.
Positive references from partner organizations in the automotive community led the client to SoftServe. The client retained us for our application security assessment, which includes:
- Threat modeling analysis
- Dynamic code testing
- Manual penetration testing
- Static code testing
- Resolution and reporting delivery
Project description
Three certified ethical hackers, a security consultant and two security engineers, tested the mobile application within a tight two-week timeframe.
The team worked to current OWASP guidelines and standards: the OWASP Application Security Verification Standard, the OWASP Top 10 Mobile Risks, and the OWASP risk rating methodology. Code analysis and scans ran on IBM AppScan Source and Veracode. The assessment used grey-box testing and was divided into three stages.
We customized the security assessment to cover eight areas:
- Data protection
- Authentication
- Session management
- Access control
- Input validation
- Cryptography
- Output encoding and escaping
- Error handling and logging
The team found a number of security gaps and closed them before release. In doing so, it prevented threats such as hacked access to the on-board computer, which could lead to invasion of privacy, malicious disorientation, or even car accidents.
Value delivered
The first version of the app was unstable and occasionally stopped working correctly. Without penetration testing, it could easily have been hacked, and that would have damaged the company’s reputation.
Within two weeks, SoftServe’s team:
- Detected a range of defects that made the application unstable and vulnerable to external intrusion
- Provided wide-ranging recommendations covering the mobile apps, the server side, and design and logic
This assessment is the first in a series of hardware security assessments of the client’s car management modules. We perform them as the company’s strategic cybersecurity service provider.
