Skip to content

Create consistency in wording in v2 tests #3559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Diolor wants to merge 15 commits into
base: master
Choose a base branch
from
Open

Create consistency in wording in v2 tests #3559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
57a75df
Create consistency in static/dynamic analysis wording tech and toolin…
Diolor Dec 1, 2025
3529b25
iOS TECH-0066 alignment
Diolor Dec 5, 2025
40681ff
Align Android tech
Diolor Dec 5, 2025
b370022
Update instructions
Diolor Dec 5, 2025
5a8588d
Align ios tech
Diolor Dec 5, 2025
8f32268
Remove some more tools from tests
Diolor Dec 5, 2025
07986df
References
Diolor Dec 5, 2025
4c338de
Merge branch 'master' into clean-dynamic-static-tech-tool-wording
Diolor Dec 18, 2025
9ab59a0
Use @MASTG-TECH-0013 instead of @MASTG-TECH-0017.
Diolor Dec 18, 2025
ee0d2f4
Update tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md
Diolor Dec 19, 2025
2d8519a
Merge branch 'master' into clean-dynamic-static-tech-tool-wording
Diolor Dec 19, 2025
8023210
Merge branch 'master' into clean-dynamic-static-tech-tool-wording
Diolor Jan 19, 2026
e9c5212
Merge branch 'master' into clean-dynamic-static-tech-tool-wording
Diolor Jan 28, 2026
d7ab8fc
Merge branch 'master' into clean-dynamic-static-tech-tool-wording
Diolor Jan 29, 2026
8cf893b
Merge branch 'master' into clean-dynamic-static-tech-tool-wording
Diolor Feb 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/instructions/mastg-test.instructions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,7 @@ Example:
```md
## Steps

1. Run @MASTG-TECH-0014 on the app and look for insecure random APIs.
1. Use @MASTG-TECH-0014 to look for insecure random APIs.
Copy link
Collaborator Author

@Diolor Diolor Dec 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please start by reviewing this. The v2 TESTs follow this pattern (where possible/TECH exists).

```

Notes:
Expand Down
2 changes: 1 addition & 1 deletion demos/android/MASVS-NETWORK/MASTG-DEMO-0048/MASTG-DEMO-0048.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ The following sample code demonstrates how to connect to a @MASTG-TOOL-0143 serv
## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Run a static analysis (@MASTG-TECH-0014) tool and look for all usages of `SSLSocket` and `HostnameVerifier`.
2. Use @MASTG-TECH-0014 to look for all usages of `SSLSocket` and `HostnameVerifier`.

{{ ../../../../rules/mastg-android-ssl-socket-hostnameverifier.yml }}

Expand Down
2 changes: 1 addition & 1 deletion demos/android/MASVS-NETWORK/MASTG-DEMO-0049/MASTG-DEMO-0049.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ However, the code implements a custom `HostnameVerifier` that performs hostname
## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Run a static analysis (@MASTG-TECH-0014) tool and look for all usages of `SSLSocket` and `HostnameVerifier`.
2. Use @MASTG-TECH-0014 to look for all usages of `SSLSocket` and `HostnameVerifier`.

{{ ../../../../rules/mastg-android-ssl-socket-hostnameverifier.yml }}

Expand Down
2 changes: 1 addition & 1 deletion techniques/android/MASTG-TECH-0005.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ platform: android

## Basic APK Installation

Use `adb install` to install an APK on an emulator or connected device. The given path is the path of the APK on the host.
Use `adb install` (@MASTG-TOOL-0004) to install an APK on an emulator or connected device. The given path is the path of the APK on the host.
Copy link
Collaborator Author

@Diolor Diolor Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fyi: This is a technique. Moved TOOL reference from the TEST to this file.


```bash
adb install ./myApp.apk
Expand Down
8 changes: 5 additions & 3 deletions techniques/android/MASTG-TECH-0013.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,10 @@ title: Reverse Engineering Android Apps
platform: android
---

Android's openness makes it a favorable environment for reverse engineers, offering big advantages that are not available with iOS. Because Android is open-source, you can study its source code at the Android Open Source Project (AOSP) and modify the OS and its standard tools any way you want. Even on standard retail devices, it is possible to do things like activating developer mode and sideloading apps without jumping through many hoops. From the powerful tools shipping with the SDK to the wide range of available reverse engineering tools, there are a lot of niceties to make your life easier.
Android's openness makes it a favorable environment for reverse engineers, offering significant advantages not available on iOS. Because Android is open-source, you can study its source code at the Android Open Source Project (AOSP) and modify the OS and its standard tools any way you want. Even on standard retail devices, it is possible to do things like activating developer mode and sideloading apps without jumping through many hoops. From the powerful tools included with the SDK to the wide range of reverse engineering tools available, there are many features to make your life easier.

However, there are also a few Android-specific challenges. For example, you'll need to deal with both Java bytecode and native code. Java Native Interface (JNI) is sometimes deliberately used to confuse reverse engineers (to be fair, there are legitimate reasons for using JNI, such as improving performance or supporting legacy code). Developers sometimes use the native layer to "hide" data and functionality, and they may structure their apps such that execution frequently jumps between the two layers.
However, there are a few Android-specific challenges as well. For example, you'll need to deal with both Java bytecode and native code. Java Native Interface (JNI) is sometimes deliberately used to confuse reverse engineers (to be fair, there are legitimate reasons for using JNI, such as improving performance or supporting legacy code). Developers sometimes use the native layer to "hide" data and functionality, and they may structure their apps such that execution frequently jumps between the two layers.

You'll need at least a working knowledge of both the Java-based Android environment and the Linux OS and Kernel, on which Android is based. You'll also need the right toolset to deal with both the bytecode running on the Java virtual machine and the native code.
You'll need at least a working knowledge of both the Java-based Android environment and the Linux OS and Kernel, on which Android is based. You'll also need the right toolset to work with both bytecode running on the Java virtual machine and native code.

To reserve engineer Android apps, consider the following techniques: @MASTG-TECH-0016, @MASTG-TECH-0017, @MASTG-TECH-0018.
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ Android apps specify a `minSdkVersion`, which defines the oldest OS version they

## Steps

1. Use either @MASTG-TECH-0014 with a tool such as @MASTG-TOOL-0110 to identify APIs that check the version of the operating system.
1. Use @MASTG-TECH-0014 to look for APIs that check the version of the operating system.

## Observation

Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,11 @@ profiles: [L1, L2]

## Overview

In this test case we will identify dependencies in Android Studio and scan them with @MASTG-TOOL-0131.
In this test case we will identify dependencies in Android Studio.

## Steps

1. Follow @MASTG-TECH-0131 and execute a scan through the build environment of Android Studio by using Gradle.
1. Use @MASTG-TECH-0131 to scan through the build environment of Android Studio by using Gradle.

## Observation

Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@ In general, if a PRNG is not explicitly documented as being cryptographically se

## Steps

1. Run a static analysis (@MASTG-TECH-0014) tool on the app and look for insecure random APIs, or you can use @MASTG-TECH-0033 to detect the use of such APIs.
2. For each of the identified API uses, check if they are used in a security relevant context. You can decompile the app (@MASTG-TECH-0017) and inspect the code (@MASTG-TECH-0023) to confirm.
1. Use @MASTG-TECH-0014 or use @MASTG-TECH-0033 to look for insecure random APIs.
2. For each of the identified API uses, check if they are used in a security relevant context. You can reverse-engineer the app (@MASTG-TECH-0013) and inspect the code (@MASTG-TECH-0023) to confirm.

## Observation

Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ Android applications sometimes use non-random sources to generate "random" value

## Steps

1. Run a static analysis (@MASTG-TECH-0014) tool on the app and look for uses of non-random sources.
1. Use @MASTG-TECH-0014 to look for uses of non-random sources.

## Observation

Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ For more information you can consult the MASTG section about ["Key Generation"](

## Steps

1. Run a static analysis tool such as @MASTG-TOOL-0110 on the code and look for uses of the cryptographic functions that generate keys.
1. Use @MASTG-TECH-0014 to look for uses of the cryptographic functions that generate keys.

## Observation

Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ In this test case, we will look for the use of hardcoded keys in Android applica

## Steps

1. Use either @MASTG-TECH-0014 with a tool such as @MASTG-TOOL-0110 or @MASTG-TECH-0033 (dynamic analysis) with a tool like @MASTG-TOOL-0001 to identify all the instances of symmetric key encryption in code and look for uses of the hardcoded cryptographic keys.
1. Use @MASTG-TECH-0014 or @MASTG-TECH-0033 to look for all the instances of symmetric key encryption in code and look for uses of the hardcoded cryptographic keys.

## Observation

Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Android also provides additional guidance on [broken cryptographic algorithms](h

## Steps

1. Run @MASTG-TECH-0014 with a tool such as @MASTG-TOOL-0110 on the app binary, or use @MASTG-TECH-0033 (dynamic analysis) with a tool like @MASTG-TOOL-0001, and look for uses of the cryptographic functions that perform encryption and decryption operations.
1. Use @MASTG-TECH-0014 or use @MASTG-TECH-0033 to look for uses of the cryptographic functions that perform encryption and decryption operations.

## Observation

Expand Down
12 changes: 6 additions & 6 deletions tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,17 @@ profiles: [L1, L2]

## Overview

To test for the [use of broken encryption modes](../../../Document/0x04g-Testing-Cryptography.md#broken-block-cipher-modes) in Android apps, we need to focus on methods from cryptographic frameworks and libraries that are used to configure and apply encryption modes.
To test for the [use of broken encryption modes](../../../Document/0x04g-Testing-Cryptography.md#broken-block-cipher-modes) in Android apps, we should focus on methods in cryptographic frameworks and libraries used to configure and apply encryption modes.

In Android development, the `Cipher` class from the Java Cryptography Architecture (JCA) is the primary API that allows you to specify the encryption mode for cryptographic operations. [`Cipher.getInstance`](https://developer.android.com/reference/javax/crypto/Cipher#getInstance(java.lang.String)) defines the transformation string, which includes the encryption algorithm, mode of operation, and padding scheme. The general format is `"Algorithm/Mode/Padding"`. For example:
In Android development, the `Cipher` class from the Java Cryptography Architecture (JCA) is the primary API for specifying the encryption mode for cryptographic operations. [`Cipher.getInstance`](https://developer.android.com/reference/javax/crypto/Cipher#getInstance(java.lang.String)) defines the transformation string, which includes the encryption algorithm, mode of operation, and padding scheme. The general format is `"Algorithm/Mode/Padding"`. For example:

```kotlin
Cipher.getInstance("AES/ECB/PKCS5Padding")
```

In this test we're going to focus on symmetric encryption modes such as [ECB (Electronic Codebook)](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_(ECB)).
In this test, we're going to focus on symmetric encryption modes such as [ECB (Electronic Codebook)](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_(ECB)).

ECB (defined in [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final)) is generally discouraged [see NIST announcement in 2023](https://csrc.nist.gov/news/2023/decision-to-revise-nist-sp-800-38a) due to its inherent security weaknesses. While not explicitly prohibited, its use is limited and advised against in most scenarios. ECB is a block cipher mode that operate deterministically, dividing plaintext into blocks and encrypting them separately, which reveals patterns in the ciphertext. This makes it vulnerable to attacks like [known-plaintext attacks](https://en.wikipedia.org/wiki/Known-plaintext_attack) and [chosen-plaintext attacks](https://en.wikipedia.org/wiki/Chosen-plaintext_attack).
ECB (defined in [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final)) is generally discouraged [see NIST announcement in 2023](https://csrc.nist.gov/news/2023/decision-to-revise-nist-sp-800-38a) due to its inherent security weaknesses. While not explicitly prohibited, its use is limited and advised against in most scenarios. ECB is a block cipher mode that operates deterministically, dividing plaintext into blocks and encrypting them separately, which reveals patterns in the ciphertext. This makes it vulnerable to attacks like [known-plaintext attacks](https://en.wikipedia.org/wiki/Known-plaintext_attack) and [chosen-plaintext attacks](https://en.wikipedia.org/wiki/Chosen-plaintext_attack).

For example, the following transformations are all [considered vulnerable](https://support.google.com/faqs/answer/10046138?hl=en):

Expand All @@ -31,13 +31,13 @@ For example, the following transformations are all [considered vulnerable](https

You can learn more about ECB and other modes in [NIST SP 800-38A - Recommendation for Block Cipher Modes of Operation: Methods and Techniques](https://csrc.nist.gov/pubs/sp/800/38/a/final). Also check the [Decision to Revise NIST SP 800-38A, Recommendation for Block Cipher Modes of Operation: Methods and Techniques](https://csrc.nist.gov/news/2023/decision-to-revise-nist-sp-800-38a) and [NIST IR 8459 Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series](https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8459.pdf) for the latest information.

**Out of Scope**: Asymmetric encryption modes like RSA are out of scope for this test because they don't use block modes like ECB.
**Out of Scope**: Asymmetric encryption modes, such as RSA, are out of scope for this test because they don't use block modes like ECB.

In the transformation strings like `"RSA/ECB/OAEPPadding"` or `"RSA/ECB/PKCS1Padding"`, the inclusion of `ECB` in this context is misleading. Unlike symmetric ciphers, **RSA doesn't operate in block modes like ECB**. The `ECB` designation is a [placeholder in some cryptographic APIs](https://github.com/openjdk/jdk/blob/680ac2cebecf93e5924a441a5de6918cd7adf118/src/java.base/share/classes/com/sun/crypto/provider/RSACipher.java#L126) and doesn't imply that RSA uses ECB mode. Understanding these nuances helps prevent false positives.

## Steps

1. Run @MASTG-TECH-0014 with a tool such as @MASTG-TOOL-0110 on the app binary, or use @MASTG-TECH-0033 (dynamic analysis) with a tool like @MASTG-TOOL-0001, and look for cryptographic functions specifying the encryption mode to insecure modes.
1. Use @MASTG-TECH-0014 or use @MASTG-TECH-0033 to look for cryptographic functions specifying the encryption mode to insecure modes.

## Observation

Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ The [`KeyGenParameterSpec.Builder`](https://developer.android.com/reference/andr

## Steps

1. Run static analysis (@MASTG-TECH-0014) on the app and look for key generation code for asymmetric keys.
1. Use @MASTG-TECH-0014 to look for key generation code for asymmetric keys.

## Observation

Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@ The API call `okhttp3.ConnectionSpec.Builder.tlsVersions(...)` can also be used

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Run a static analysis (@MASTG-TECH-0014) tool on the reverse engineered app targeting calls to APIs setting the TLS protocol.
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Use @MASTG-TECH-0014 on the reverse-engineered app to look for calls to APIs setting the TLS protocol.

## Observation

Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,8 @@ An Android app may have hardcoded HTTP URLs embedded in the app binary, library

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Run a static analysis (@MASTG-TECH-0014) tool and look for any `http://` URLs.
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Use @MASTG-TECH-0014 to look for any `http://` URLs.

## Observation

Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@ Such unsafe implementations can allow an attacker to run a [MITM attack](../../.

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Run a static analysis (@MASTG-TECH-0014) tool and look for all usages of `SSLSocket` and `HostnameVerifier`.
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Use @MASTG-TECH-0014 to look for all usages of `SSLSocket` and `HostnameVerifier`.

## Observation

Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Since Android 9 (API level 28) cleartext HTTP traffic is blocked by default (tha

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Obtain the AndroidManifest.xml.
3. Obtain the Network Security Configuration.
4. Read the value of `usesCleartextTraffic` from the AndroidManifest.xml.
Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ The goal of this test is to check if the app does not implement certificate pinn

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Obtain the AndroidManifest.xml (@MASTG-TECH-0117), and check if a `networkSecurityConfig` is set in the `<application>` tag.
3. Inspect the referenced network security config file, and extract all domains from `<domain-config>` which have a pin set (`<pin-set>`).

Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ The goal of this test is to check if any expiration date is in the past.

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and extract the expiration dates for every domain.

## Observation
Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,8 @@ Such unsafe implementations can allow an attacker to run a [MITM attack](../../.

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Run a static analysis (@MASTG-TECH-0014) tool for the app and look for all usages of `checkServerTrusted(...)`.
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Use @MASTG-TECH-0014 to look for all usages of `checkServerTrusted(...)`.

## Observation

Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ Such unsafe implementations can allow an attacker to run a [MITM attack](../../.

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Inspect the source code and run a static analysis (@MASTG-TECH-0014) tool and look for all usages of `HostnameVerifier`.
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Inspect the source code and use @MASTG-TECH-0014 to look for all usages of `HostnameVerifier`.

## Observation

Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@ This effectively bypasses SSL certificate checks in the `WebView`, exposing the

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Inspect the source code and run a static analysis (@MASTG-TECH-0014) tool and look for all usages of `onReceivedSslError(...)`.
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Inspect the source code and use @MASTG-TECH-0014 to look for all usages of `onReceivedSslError(...)`.

## Observation

Expand Down
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ This test checks whether the Android app ensures the Security Provider is [updat

## Steps

1. Reverse engineer the app (@MASTG-TECH-0017).
2. Use static analysis (@MASTG-TECH-0014) to search for usage of `ProviderInstaller.installIfNeeded` or `ProviderInstaller.installIfNeededAsync`.
1. Use @MASTG-TECH-0013 to reverse-engineer the app.
2. Use MASTG-TECH-0014 to look for usage of `ProviderInstaller.installIfNeeded` or `ProviderInstaller.installIfNeededAsync`.

## Observation

Expand Down
Loading