Descriptions for the OWASP MobileApp Edition cards on cornucopia.owasp.org

[sydseter]

The mobile app edition lacks descriptions for each of the cards in the edition on the website (see issue: #2109).

Work has started on filling out the descriptions for some of the cards based on the MASTG and MASVS mapping and the physical card descriptions:

https://cornucopia.owasp.org/cards/AA2
https://cornucopia.owasp.org/cards/AA3

The descriptions are made humorous on purpose in order to give the game a playful feel, but the remaining cards needs to be filled out in the same way, each with a unique scenario and STRIDE category (e.g: https://cornucopia.owasp.org/cards/ATK#STRIDE).

If you want to contribute please tell us which card you want to work on here , you can only work on one card at the time. Early bird gets the worm!

The text for each card can be found here: https://github.com/OWASP/cornucopia/tree/master/cornucopia.owasp.org/data/cards/mobileapp-cards-1.1-en

The situation falls under the {fill in STRIDE category} category in the STRIDE threat modeling framework.

1. One pull-request per card.
2. Announce the card you want to work on.
3. Wait for a thumbs up.
4. Ask questions in the discussion thread.
5. Remember to add yourself to the alphabetical contributor list: https://github.com/OWASP/cornucopia/blob/master/cornucopia.owasp.org/data/website/pages/about/en/index.md#volunteers

[muhammad7865]

Subject: Claiming Card AA5 (Mobile App Edition)

Hi team! I'd like to work on Card AA5 ("Eiman can bypass the local authentication...").

My Approach:

Scenario: Focus on "Eiman" using dynamic instrumentation (like Frida) to bypass a PIN check because he's too lazy to type it.
Mapping: I'll map this to Tampering (modifying the app/runtime) leading to Elevation of Privilege.
Mitigation: Emphasizing server-side validation and cryptography over client-side UI checks.

I will create a PR shortly!

[sydseter]

Go ahead! Thank you for your time!

[muhammad7865]

Description

This PR addresses Card AA5 (Authentication & Authorization) for the Mobile App Edition. I have added a humorous yet technical scenario ("Eiman") that explains local authentication bypass via dynamic instrumentation, consistent with the tone of other cards.

Changes

• Updated cornucopia.owasp.org/data/cards/mobileapp-cards-1.1-en/authentication-&-authorization/AA5/explanation.md with scenario, STRIDE mapping (Tampering/EoP), and mitigations.
• Added myself to the volunteers list in cornucopia.owasp.org/data/website/pages/about/en/index.md.

Related Issue

Fixes #2125

[sydseter]

You closed the pr?

[muhammad7865]

Still figuring it out , asked for some help on LinkedIn too

[muhammad7865]

Subject: Claiming Card AA6 (Mobile App Edition)

Hi team! I'd like to work on Card AA6 ("Anant can perform sensitive operations without additional authentication...").

My Approach:
Scenario: Focus on "Anant" replaying a "Withdraw" request without re-authenticating, exploiting the lack of server-side step-up auth.
Mapping: I'll map this to Spoofing (acting as valid user) and Elevation of Privilege (unauthorized sensitive action).
Mitigation: Emphasizing server-side step-up authentication (2FA/biometric) and freshness checks for sensitive operations.

I will create a PR shortly!

[sydseter]

Your bank app example is valid, but we should probably avoid pulling in server-side authentication here, as it could be confusing in the context of mobile app development.

[muhammad7865]

Subject: Claiming Card AA6 (Mobile App Edition) - Revised

Hi team! I'd like to work on Card AA6 ("Anant can perform sensitive operations without additional authentication...").

Based on the feedback, I've refined the approach to focus on client-side controls.

My Approach:
Scenario: Focus on "Anant" bypassing a local authentication check (e.g., to view a saved password or disable app lock) because the app relies on simple boolean logic instead of cryptographic binding.
Mapping: I'll map this to Tampering (bypassing logic) and Information Disclosure (accessing sensitive data without valid auth).
Mitigation: Emphasizing Keychain (iOS) and Keystore (Android) usage, specifically keys that require user authentication (e.g., setUserAuthenticationRequired(true)), ensuring data allows decryption only after a successful biometric/PIN entry.

I will create a PR shortly!

[sydseter]

Cool, great!

[sydseter]

I really liked your example: https://github.com/OWASP/cornucopia/pull/2143/changes 😆

[muhammad7865]

Fixes #2145

[sydseter]

aa7 is available again.

[ishaP10]

Hello @sydseter since it's available again, I'd like to claim AA7 as my first card. I'll get started on the humorous scenario and STRIDE mapping right away. Thanks for the time!!

[sydseter]

go ahead!