[ISN] Are FBI's Android data-sharing apps hacker-proof?

http://www.nextgov.com/cybersecurity/2012/07/are-fbis-android-data-sharing-apps-hacker-proof/56773/

By Dawn Lim
Nextgov.com
July 13, 2012

The FBI plans to tap George Mason University scientists to perform tests 
on the law enforcement agency's Android mobile applications to see if 
they are hacker-proof, a notice of intent reveals.

The bureau will match funding provided by the military venture capital 
arm, Defense Advanced Research Projects Agency, to help tailor testing 
systems to the FBI's specific needs.

With DARPA money, researchers in the GMU computer science department 
have been working on a systematic approach to carrying out fuzzing 
attacks – the feeding of unexpected data into a computer program as a 
form of brute-force exploitation. Last year, Regina Dugan, then-director 
of DARPA, announced that the agency was interested in supporting 
offensive cyber capabilities.

Fuzz testing apps so far have lacked sophisticated or guided techniques, 
according to a paper outlining the DARPA-funded research. The scientists 
have been seeking to develop a “scalable approach for intelligent fuzz 
testing of Android applications” with the help of cloud computing. “The 
framework uses numerous heuristics and software analysis techniques to 
intelligently guide the generation of test cases aiming to boost the 
likelihood of discovering vulnerabilities,” the paper adds.

The team chose to focus on the Android operating system because it has 
one of the most widely used and vulnerable app markets. Also, because 
Android is an open-source platform, it is ideal for experimentation in 
the laboratory, the scientists said.

[...]


--
Learn how to be a Pen Tester, CISSP, ISSMP, or ISSAP with Expanding Security online.
Come to a free class and see how good and fun the program really is.
http://www.expandingsecurity.com/PainPill