AI
The Three Layers of the OWASP MAS Project
The MAS project splits into three parts. MASVS is the standard: eight control groups expressed as short, precise sentences applicable to both iOS and Android. MASTG is the testing guide, large enough to match a phone book, documenting how to verify every control. Since 2017, contributors worldwide have built both. Now a third deliverable, MASWE, bridges them. Everything lives on mas.owasp.org as Markdown files backed by GitHub. Any weakness or test case is editable via pull request.
Turning Broad Controls into Testable Weaknesses
MASWE maps broad controls to specific, testable weaknesses. One MASVS control reads: “the app employs current, strong cryptography and uses it according to industry best practices.” That states the goal but not what to test. MASWE narrows it to a weakness: “cryptographically weak PRNG.” One test under that weakness checks for insecure random API usage on Android, including the Java Random class and System.currentTimeMillis() in place of a secure RNG. Each weakness entry lists its platform scope, MASVS mapping, and applicable security profiles.
How Each Weakness Becomes a Runnable, Verified Test
The demo layer goes further than test descriptions. Each weakness links to runnable code samples shown in both original and decompiled form, since attackers reverse-engineer rather than read source. Two reference apps, one Android and one iOS, are maintained in separate repos so every demo runs end-to-end. For the non-random sources weakness, the demo ships a Semgrep rule matching System.currentTimeMillis() and date-based seeds. Running it against the sample app returns two matches. The test fails.
Automated APK Builds and Continuous Test Validation
GitHub Actions pipelines assemble each demo automatically. The workflow takes a sample code file, patches it into the MAS test app, and produces a downloadable APK for each weakness. Once downloaded, the APK can be unzipped and browsed as Smali in Android Studio, or targeted by the Frida scripts included in the demo. One Frida hook caught the app writing a sensitive file to external storage at runtime. The plan is to run all test scripts in CI as well, so the pipeline validates tests across Android versions. iOS pipeline support is planned.
Q&A
Does MAS cover cross-platform frameworks like React Native and Flutter? MAS focuses only on Swift and Kotlin native code; a cross-platform initiative ran several years ago but was abandoned because keeping pace with native development alone is already demanding. ▶ Watch (25:32)
How does MAS relate to the OWASP Mobile Top 10? MAS provides a holistic view for both developers and pentesters, covering controls, test methodology, and weaknesses; the Mobile Top 10 aggregates vulnerabilities reported by external companies and serves a different, higher-level purpose. ▶ Watch (26:58)
Notable Quotes
what kind of risk does this actually have this specific weakness Sven Schleier · ▶ Watch (11:07)
when we test this apps we do it from the perspective of an attacker Carlos Holguera · ▶ Watch (14:54)
to test it with these apps so you can be sure that all this demos will be working Carlos Holguera · ▶ Watch (18:03)
Key Takeaways
- MASWE maps each MASVS control to specific weaknesses with unique IDs, platform scope, and security profiles.
- Every weakness links to runnable demos with Semgrep rules and Frida scripts tested against real Android and iOS apps.
- GitHub Actions pipelines auto-generate a downloadable APK per demo; running test scripts in CI is the next planned step.
About the Speaker(s)
Sven Schleier is a Principal Security Consultant at Crayon in Austria, leading professional services for cloud security. He has extensive experience in penetration testing and application security, with a focus on guiding software development teams. Sven has co-led the OWASP MAS project since 2017.
Carlos Holguera is a principal mobile security research engineer at NowSecure and a core project leader and author of the OWASP MASTG and MASVS, the industry-standard references for mobile application security testing and verification.