Skip to content
Sign in
Artwork for CyberCode Academy
CyberCode Academy · September 11 · 20 min

Course 42 - Mobile Malware Analysis Fundamentals | Episode 15: iOS and Android Case Studies and Reporting

This module provides a hands-on exploration of mobile malware analysis through two distinct case studies, one for iOS and one for Android, designed to let you work independently to uncover the functionality of malicious programs. The episode is structured into the following key components: 1. iOS Case Study: Corporate Security Assessment The first scenario involves a corporate iPhone reported for "acting weird". As a security analyst, your goal is to: Assess the Risk: Determine if the corporate network is at risk or if company policies were violated. Analyze Functionality: Use techniques like running strings or Mob SF (especially if you lack a Mac or iDevice) to uncover what the application is doing. Structured Reporting: Create a report including a cover page, executive summary, and detailed sections for static, dynamic, and network analysis. 2. Android Case Study: The "Free" App Investigation The second scenario focuses on a "free" version of a paid Pokemon Go application that is unexpectedly consuming a user's entire data plan. You are tasked with: Investigating Data Usage: Uncover why the app is depleting data so rapidly. Avoiding Online Tools: The exercise encourages staying away from automated online analysis to practice manual techniques. Documentation: Provide a written report for the "client" that includes the same core analysis sections (static, dynamic, and network). 3. Reporting and Documentation Standards A major focus of this episode is the professional documentation of findings. The sources provide a template for a successful report, which should include: High-Level Overviews: Title pages, tables of contents, and executive summaries for non-technical stakeholders. Technical Deep Dives: Detailed results from debugging, static analysis (such as mutexes or registry keys), and network traffic monitoring. Comparative Learning: After completing your analysis, you are encouraged to compare your findings and report format against provided examples to evaluate your performance. You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

0:00-20:39
Play in
Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

This module provides a hands-on exploration of mobile malware analysis through two distinct case studies, one for iOS and one for Android, designed to let you work independently to uncover the functionality of malicious programs. The episode is structured into the following key components: 1. iOS Case Study: Corporate Security Assessment The first scenario involves a corporate iPhone reported for "acting weird". As a security analyst, your goal is to:
  • Assess the Risk: Determine if the corporate network is at risk or if company policies were violated.
  • Analyze Functionality: Use techniques like running strings or Mob SF (especially if you lack a Mac or iDevice) to uncover what the application is doing.
  • Structured Reporting: Create a report including a cover page, executive summary, and detailed sections for static, dynamic, and network analysis.
2. Android Case Study: The "Free" App Investigation The second scenario focuses on a "free" version of a paid Pokemon Go application that is unexpectedly consuming a user's entire data plan. You are tasked with:
  • Investigating Data Usage: Uncover why the app is depleting data so rapidly.
  • Avoiding Online Tools: The exercise encourages staying away from automated online analysis to practice manual techniques.
  • Documentation: Provide a written report for the "client" that includes the same core analysis sections (static, dynamic, and network).
3. Reporting and Documentation Standards A major focus of this episode is the professional documentation of findings. The sources provide a template for a successful report, which should include:
  • High-Level Overviews: Title pages, tables of contents, and executive summaries for non-technical stakeholders.
  • Technical Deep Dives: Detailed results from debugging, static analysis (such as mutexes or registry keys), and network traffic monitoring.
  • Comparative Learning: After completing your analysis, you are encouraged to compare your findings and report format against provided examples to evaluate your performance.


You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
links1

more episodes

All episodes