OVERVIEW

The course aims to introduce the main security mechanisms of mobile operating systems and applications and present the core techniques, methodologies and tools for the vulnerability assessment and penetration testing of Android and iOS applications. The course involves both lectures and practical sessions for students.

AIMS AND CONTENT

LEARNING OUTCOMES

The teaching unit aims to introduce the main security mechanisms of mobile operating systems and applications and present the core techniques, methodologies and tools for the vulnerability assessment and penetration testing of Android and iOS applications. The teaching unit involves both lectures and practical sessions for students.

AIMS AND LEARNING OUTCOMES

Learning Outcomes:

- Acquire the main security mechanisms of mobile operating systems and applications;

- Know the most important vulnerability classes for mobile applications;

- Understand the methodologies and techniques to perform vulnerability assessment and penetration testing activities on mobile applications;

- Perform security assessment activities on Android and iOS applications and prepare security reports;

PREREQUISITES

- Mobile Programming

- Foundations of Cyber Security

- Foundation of Object oriented programming, operating systems, and databases

TEACHING METHODS

Lectures plus individual hands-on during the course.

Students who hold valid certificates relating to Specific Learning Difficulties (SLD), disabilities or other educational needs are invited to contact the lecturer and the school’s disability liaison officer at the start of the course to agree on any teaching arrangements which, whilst respecting the course objectives, take into account individual learning styles. 

The contact details for the university’s disability liaison officer are available at the following link: https://unige.it/commissioni/comitatoperlinclusionedeglistudenticondisabilita. 

SYLLABUS/CONTENT

• Security Model of Mobile OSes (Android, iOS)

• Anatomy of Android and iOS Apps

• Security of Android and iOS Apps

• Vulnerability Assessment (VA) and Penetration Testing (PT) Methodologies

• Reverse Engineering of Mobile Apps

• Static Application Security Testing (SAST)

• Dynamic Application Security Testing (DAST)

• Lab: VA/PT of Mobile Apps (lab)

RECOMMENDED READING/BIBLIOGRAPHY

The teacher provides slides and exercises (in English) during the course.

TEACHERS AND EXAM BOARD

Exam Board

LUCA VERDERAME (President)

LESSONS

LESSONS START

https://easyacademy.unige.it/portalestudenti/index.php?view=easycourse&_lang=it&include=corso

Class schedule

The timetable for this course is available here: Portale EasyAcademy

EXAMS

EXAM DESCRIPTION

Project: execution of a vulnerability assessment and penetration testing activity of a set of applications for Android and iOS to be agreed together with the teacher. At the end of the activity, the student must present a report with a discussion of the activities carried out and the details of the identified vulnerabilities. It is also possible to propose a custom project on topics related to mobile security, to be agreed upon in advance with the instructor.

Students with certification of Specific Learning Disabilities (SLD), disabilities, or other special educational needs must contact the instructor at the beginning of the course to agree on teaching and examination methods that, while respecting the course objectives, take into account individual learning styles and provide appropriate compensatory tools. It is reminded that the request for compensatory/dispensatory measures for exams must be sent to the course instructor, the School representative, and the “Settore servizi per l'inclusione degli studenti con disabilità e con DSA” office (dsa@unige.it) at least 10 working days before the test, as per the guidelines available at the link: https://unige.it/disabilita-dsa

ASSESSMENT METHODS

Pitch of the iresults of the project and oral discussion. The final evaluation will take into account:

• class attendance;

• the knowledge of the course contents tested with the project;

• the problem-solving skills tested with the project;

• the communication skills tested during the oral presentation.

FURTHER INFORMATION

Students with valid certifications for Specific Learning Disorders (SLD) may request accommodations for exams at least 7 days prior to the exam date by filling out the “accommodation request form” (available via online services at https://modulionline.unige.it/richiesta-adattamenti# no-back), which will be automatically forwarded by the system to the instructor in charge of the course and to the faculty liaison for students with disabilities and SLDs in their School/Department. 

The student will receive a copy of their request.