CNIT 128: Hacking Mobile Devices

39102 Weds 06:10-09:00 pm SCIE 113

Moved to SCIE 37

Spring 2019 Sam Bowne

Schedule · Slides · Projects · Links · Home Page

Catalog Description

Mobile devices such as smartphones and tablets are now used for making purchases, emails, social networking, and many other risky activities. These devices run specialized operating systems have many security problems. This class will cover how mobile operating systems and apps work, how to find and exploit vulnerabilities in them, and how to defend them. Topics will include phone call, voicemail, and SMS intrusion, jailbreaking, rooting, NFC attacks, malware, browser exploitation, and application vulnerabilities. Hands-on projects will include as many of these activities as are practical and legal.

Advisory: CNIT 113 and 123, or equivalent familiarity with hacking computers and operating mobile devices

Upon successful completion of this course, the student will be able to:
  1. Describe the risks of using mobile devices for common activities such as making phone calls, emailing, and shopping
  2. Explain cellular network functions, attacks, anbd countermeasures for voice calls, voicemail, and SMS
  3. Perform and analyze jailbreaks for iOS devices
  4. Analyze the Android security model and rooting
  5. Recognize types of mobile malware and anti-malware options
  6. Identify Web browser services and attacks on mobile platforms and recommend countermeasures
  7. Configure and defeat locking, remote location and wiping services
  8. Explain common mobile app risks and make intelligent decisions when installing and using them
  9. Evaluate the functions and risks of mobile payment services, such as Google Wallet


"The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell, Wiley; 1 edition (February 24, 2015), ISBN-10: 1118958500 ISBN-13: 978-1118958506

Buy from Amazon ($49)


The quizzes are multiple-choice, online, and open-book. Study the textbook chapter and take the quiz before that class. Each quiz is due 30 min. before class. Each quiz has 5 questions, you have ten minutes to take it, and you can make two attempts.

To access the quizzes:

  • Go to
  • If you've taken one of my class previously, you should already have an account on this Canvas server (it's NOT the usual CCSF Canvas system). Otherwise, create a new account.
  • You should see the quizzes, as shown below.
  • Questions? Email

Live Streaming

To join the livestream, use this Zoom link:

Classes will also be recorded and published on YouTube for later viewing.


For class-related questions, please email

Schedule (may be revised)

DateQuiz & ProjTopic
Wed 1-16  Is Your Mobile App Secure?

Wed 1-23Quiz Ch 1 *  
Proj 1 due *
1. Mobile Application (In)security

Wed 1-30Quiz Ch 6a *
Proj 2 & 3 due *
6. Analyzing Android Applications (Part 1)

Fri 2-3 Last Day to Add Classes

Wed 2-6Quiz Ch 6b *
Proj 4 due
6. Analyzing Android Applications (Part 2)

Wed 2-13Quiz Ch 6c *
Proj 4 due
6. Analyzing Android Applications (Part 3)

Live testing of mobile apps

Wed 2-20Quiz Ch 7a *
Proj 5 & 6 due
7. Attacking Android Applications (Part 1)

Wed 2-27Quiz Ch 7b *
Proj 7 due
7. Attacking Android Applications (Part 2)

Wed 3-6Proj 8 due 7. Attacking Android Applications (Part 3)

Wed 3-13Quizzes Ch 7c & Ch 8a *
Proj 9 & 10 due
8. Android Implementation Issues (Part 1)

Wed 3-20Quiz Ch 8b *
Proj 11 & 12 due
8. Android Implementation Issues (Part 2)

Wed 3-27 Holiday -- No Class

Wed 4-3No Quiz
No Proj Due
Neil Desai
Defense and Careers

Video from BSides Knoxville 2015

This talk will be livestreamed and recorded


Wed 4-10Quiz Ch 8c *
Proj 14 & 15 due
8. Android Implementation Issues (Part 3)

Wed 4-17Quiz Ch 9 *
Proj 16 due
9. Writing Secure Android Applications

Wed 4-24No Quiz
No Proj due
Abdullah Joseph

Android Malware

New Android adware found
in 200 apps on Google Play


Wed 5-1No Quiz
No Proj Due
Ayman Elsawah

Host of the Getting Into Information Security podcast

Wed 5-8
Proj 17 due
2. Analyzing iOS Applications (Part 1)

Wed 5-15No Quiz
All Extra Credit Projects Due
Last class
2. Analyzing iOS Applications (Part 2)

Thu 5-16 -
Wed 5-22
Final Exam available online throughout the week.
You can only take it once.
* Quizzes due 30 min. before class
  Nothing is consided late until 2-6


Grading Policy


Is Your Mobile App Secure? (DEF CON 23, 2015) · PDF · Keynote
Passwords on a Phone (DEF CON 25, 2017) · PDF · Keynote


1. Mobile Application (In)security · PDF · Keynote


6. Analyzing Android Applications Part 1 · PDF · Keynote
Part 2 · PDF · Keynote
Part 3 · PDF · Keynote
7. Attacking Android Applications Part 1 · PDF · Keynote
Part 2 · PDF · Keynote
Part 3 · PDF · Keynote
8. Identifying and Exploiting
    Android Implementation Issues
Part 1 · PDF · Keynote
Part 2 · PDF · Keynote
Part 3 · PDF · Keynote
9. Writing Secure Android Applications · PDF · Keynote


2. Analyzing iOS Applications Part 1 · PDF · Keynote
Part 2 · PDF · Keynote


Initial Setup (Different for Mac/Linux and PC)

Mac or Linux Users

Proj 1: Genymotion (15 pts)
Proj 2: Ask A Lawyer Plaintext Login (15 pts)
Proj 3: Burp (20 pts)
Proj 4: GenieMD Broken SSL (Harvard & IBM) (15 pts)
Proj 5: Kali Virtual Machine (20 pts) *
Proj 6: Android Debug Bridge (15 pts) *

PC Users

Proj 4x: BlueStacks on Windows (15 pts)
Proj 7x: Plaintext Login (15 pts)
Proj 8x: Burp and Nox on Windows (20 pts)
Proj 4: GenieMD Broken SSL (Harvard & IBM) (15 pts)
Proj 5: Kali Virtual Machine (20 pts) *
Proj 9x: Android Debug Bridge with Nox (15 pts) *

Projects Below Should Work on Mac, Linux, or Windows

Proj 7: Observing the Delhaize Log (15 pts)
Proj 8: Menards Plaintext Password Storage (15 pts)
Proj 9: ES Explorer Command Injection (10 pts)
Proj 10: Drozer (20 pts)
Proj 11: Qark (15 pts)
Proj 12: Trojaning the Progressive App (20 pts) (Updated 3-19-19)
Proj 13: Home Depot Android App Broken Encryption (NOW EXTRA CREDIT) (15 pts)
Proj 14: mAadhaar Code Modification (20 pts)
Proj 15: AndroBugs (10 pts)
Proj 16: Protection Level Downgrade (15-30 pts)
Proj 17: Trojaning an Android App with Metasploit (15 pts)

Extra Credit Projects

Proj 1x: Interplanetary Overlay Network (ION‑DTN) (15 pts + 10 pts extra)
Proj 2x: Ask A Lawyer Plaintext Password Storage (10 pts)
Proj 3x: Security Audit of An Android App (40 pts)

Proj 4x: BlueStacks Android Emulator on Windows (15 pts)
Proj 4x: BlueStacks Android Emulator on Mac or Linux (15 pts)

Proj 5x: Bank of America Code Modification (25 pts)
Proj 6x: Rooting BlueStacks on Windows (10 pts)
Proj 10x: Making an SSL Auditing Proxy with a Mac and Burp (20 pts)
Proj 11x: Ghidra (25 pts)
Proj 12x: Android Password Cracking with Nox (40 pts)
Proj 13x: Bypassing a Screen Lock with Nox (10 pts)
Proj A30: Android App Plaintext Login (55 pts)

* Project sends scores directly into Canvas


Apple Platform Security
Apple Platform Security PDF
DVIA (Damn Vulnerable iOS App) | A vulnerable iOS app for pentesting
OWASP/owasp-masvs: The Mobile Application Security Verification Standard (MASVS) is a standard for mobile app security.
2019-12-29: Hybrid App Developers: Don't Store Your User's Passwords
Passwords are the biggest threat to GDPR compliance (Mar. 2019)
Chat app Knuddels fined 20 k Eurosunder GDPR regulation (Nov 24, 2018)
Remote logging for mobile apps (April, 2019)
From checkra1n to Frida: iOS App Pentesting Quickstart on iOS 13 --
Project Zero: Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641 (Jan. 2019)
Project Zero: Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass (Jan. 2019)
Project Zero: Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution (Jan. 2019)
Reverse-Engineering-and-Tampering iOS Apps OWASP
GDB to LLDB command map -- The LLDB Debugger
Google Maps Platform--Protecting API Keys
We reverse engineered 16k apps, here's what we found
Hands On Mobile API Security: Get Rid of Client Secrets
Why OAuth API Keys and Secrets Aren't Safe in Mobile Apps
Hey Developer, Give me your API keys.!!
Ch 2b: Hack in the (sand)Box
Android App Reverse Engineering 101 | Learn to reverse engineer Android applications!
DJI Privacy Analysis Validation--GOOD ANDROID PROJECT
Oversecured detects dangerous vulnerabilities in the TikTok Android app--USE FOR PROJECT
AndroGoat: Vulnerable Android App
Ch 6a: Encryption  |  Android Open Source Project
Ch 6b: Android versions market share
Ch 7a: Android activity manager "am" command help
2021-02-22: Virtual iPhones with Free Trial!
pidcat: Colored logcat script which only shows log entries for a specific application package.
Ch 7b: Service vs IntentService in Android
Can I Jailbreak? - Home
Jailbreaking iOS for Mobile Security Assessments (March 2021 Edition) - SANS Institute
Ch 8a: What happens if you enter the wrong PIN for many times in an Android phone? - Quora
Ch 8b: How to reset your Android lock screen password/PIN/pattern - TechRepublic
Ch 8c: Android WebView addJavascriptInterface Code execution Vulnerability
MOBISEC - Mobile Security Course


Links from Previous Textbook

Last Updated: 5-16-19 8:52 am