Look Who it Was Random video

Marion Mccune - Metro down the Tube. Security Testing Windows Store Apps

185 views · Published 4 July 2014 · 46:49 · Indexed 28 October 2026

Channel: OWASP Foundation · 2014 · Science & Technology

Watch on YouTube

From AppSecEU 2014 in Cambridge
https://2014.appsec.eu/

This presentation will cover "Metro", "Modern" or (more correctly) "Windows Store" Apps and how to perform security reviews on them. Like it or not, this is the direction Microsoft are going in, and it seems likely that this style of centrally controlled, sandboxed application is the future for at least some types of Windows programs. The focus of the talk will be Store Apps developed in HTML and JavaScript (although other types of app will be mentioned). I will explain what a Store App is, and how it differs from a normal Windows application, and also from a web site. 

In the first section I cover the architecture and theory of Store apps. I go over the different types of development frameworks which can be used to create them, and how they get from a developer's PC to the Windows Store, including what Microsoft do (and don't do) as far as security testing is concerned. I'll also compare and contrast this type of apps with ones from other architectures (Win32 and mobile). 

The second section of the presentation then explains (and shows) how to set up an environment (Windows 8.1, a web proxy of choice and Visual Studio) to test a Store application -- there are some tricks to this which are not well publicised. I'll point out where apps are stored, how you get access to them, and how to go about testing them including code review examples (focusing on secure and insecure JavaScript). I'll show the use of a web service in an app and how this technology can present a security hole in the app sandbox. 

In conclusion I will make some comments on where the move to a Store based system in the Windows environment (over 90% of PC class devices) is taking us from a security perspective, and how this fits (in my opinion) with the future development of Windows Phone and RT. 

The presentation as a whole gives an introduction to an area of application testing which is not well known but is likely to become more critical as time advances and the Store system becomes more mature. 

Speakers

Marion Mccune
Director, ScotSTS Ltd
I'm a director of a small security consultancy specializing in testing Web Applications. | My specific fields of interest are ASP.NET, Store Apps and WP8. | | I live in rural Argyll with my partner Rory, two cats, three Surfaces and a visiting pine marten.


-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project

More from this channel