Standardizing Mobile Defense: Inside the OWASP Mobile App Security Project v2 - Jan Seredynski, Ryan Lloyd - ASW #405
Summary
In this episode, Mike Shima interviews Ryan Lloyd and Jan Saradinsky about the OWASP Mobile Application Security Project’s recent updates, including the removal of the Top 10 list in favor of a comprehensive catalog of roughly 80 specific weaknesses. The guests explain how the new Mobile Security Testing Guide and Verification Standard provide developers with concrete, testable criteria organized into essential, advanced, and resilience profiles.
Topics discussed
Intro, Halloween jokes, and guest introductions
Overview of the OWASP Mobile Application Security Project
Critique of Top 10 lists and the value of substance
Improvements in referencing and structure in V2
Sponsor break: GuardSquare
Key mobile weaknesses: storage, crypto, and privacy
Deep dive into internal vs external storage risks
Debate: Weakness vs Vulnerability terminology
Developer-oriented design and ASVS checklist approach
Inter-app communication and privacy antagonism
Testing profiles: Essential, Advanced, and Resilience
Resilience profile and user-as-attacker scenarios
Testing tools and step-by-step demos in the guide
Using LLM agents for mobile app testing
Current status of LLM-specific weaknesses in the project
LLMs in development, bug hunting, and reverse engineering
Sponsor break: ThreatLocker
Applying mobile security lessons to AI agents
Developer feedback and the utility of specific URLs
Adoption strategies: PMs, developers, and common language
Praise for plain language and reduced jargon
New testing profiles: EU Digital Identity and others
Platform limitations and the need for new APIs
The challenge of supporting legacy Android versions
Evolution of mobile apps from web wrappers to native
Fragmentation and the complexity of mobile ecosystems
Future outlook: LLMs as a new verification standard
New security challenges from LLMs and agents in mobile
AI exposing existing security gaps rather than new ones
The challenge of implementing sufficient controls
How to contribute to the OWASP Mobile AppSec project
GitHub activity and project traction
The cat-and-mouse nature of mobile app security
Closing remarks and thanks to guests
Outro and final sign-off
Listen ad-free on Castria