n0where

(Cross-posted from the Intrepidus Group Insight blog)

As one of the project leaders for the OWASP Mobile Security Project, it behooved me to help present, nay unveil the Release Candidate of the OWASP Top 10 Mobile Risks at OWASP AppSec USA 2011. Along with two of the other project leaders — Jack Mannino, of nVisium Security, and Mike Zusman, of Carve Systems — we discussed the general goals of the OWASP Mobile Security Project, its history, and finally the Top 10 Risks themselves. For each entry, we tried to provide an example of bad design or insecure coding practice that would give rise to such a risk, and/or a real world news story resultant of the associated risk item. We received great feedback from attendees, and it seemed some were very charged and passionate about the “top 10″ presented there. As mentioned in the slide deck, there is a 60-day window (from the unveiling) in which the RC Top 10 can be refuted or changed before we push it up to “Final” (that window ends on November 22).

The slide deck is available over at SlideShare.

We encourage anyone who’s interested to get involved in the OWASP Mobile Security Project (visit the OWASP wiki for information on mailing lists and other ways to help). With the Top 10 Risks and Top 10 Controls finally seeing the light of day, we’ve made some headway, but we’ve still got a long way to go.

I will be teaming up once again with my good buddy, teen idol sensation, and the first half of the "JOCH" in "TEAM JOCH", Mr. Jon Oberheide, to teach a two-day training session on mobile hacking/penetration testing at SOURCE Barcelona this November. Leveraging our over 9000 years* of security experience and knowledge, we'll be giving our students the information, knowledge, and demonstrations they need to dive into attacking mobile platforms and applications, as well as knowing where and how to discover new vulnerabilities and flaws in these targets.

Information about the class, and the conference, along with registration, can be found at the SOURCE Barcelona site.

* - number may be inflated for dramatic effect