Introduction and background:

This is the first article in a series of articles aimed at discussing Windows Mobile Application Penetration Testing. Let us begin with knowing some details about Windows Phone 8.1 and Windows 10 Mobile.

Windows Phone 8.1:

Windows Phone 8.1 is the third generation of Microsoft’s Windows Phone mobile operating system, succeeding Windows Phone 8. All Windows Phones running Windows Phone 8 can be upgraded to Windows Phone 8.1, with release dependent on carrier rollout dates.

Windows Phone 8.1 is also the last version that uses the Windows Phone brand name as it was succeeded by Windows 10 Mobile. Some Windows Phone 8.1 devices are capable of being upgraded to Windows 10 Mobile.

Windows 10 Mobile:

Windows 10 Mobile is a mobile operating system developed by Microsoft. It is an iteration of the Windows Phone product line and a successor to Windows Phone 8.1 and is an edition of Windows 10, Microsoft’s operating system for personal computers, as part of Microsoft’s plans to unify Windows’ application platform across multiple device classes.

Windows 10 Mobile aims to provide greater consistency with its counterpart for personal computers, including more extensive synchronization of content, a new universal application platform that allows one app to run on multiple Windows 10 devices such as PCs, mobile devices, and Xbox, as well as the capability, on supported hardware, to connect devices to an external display and use a “PC-like” interface with mouse and keyboard input support. Microsoft has built tools for developers easily to port some iOS apps with minimal modifications. Windows Phone 8.1 smartphones are eligible for an upgrade to Windows 10 Mobile, under manufacturer and carrier support.

Windows 10 Mobile is designed for use on smartphones and phablets, running on ARM as well as IA-32 processor architectures.

Please note that the above details are taken from Wikipedia and references are provided at the end of the article.

Windows Phone Application Penetration Testing:

Windows Mobile Application Penetration testing is a less discussed subject on the Internet compared to Android and iOS application penetration testing.

The following table shows the Smart Phone sales to end users by Operating System.

http://www.gartner.com/newsroom/id/3415117

Though Android and iOS are leading the smartphone market, the investment that Microsoft is making in developing free training materials for developers and the efforts that are made to bring Universal Windows Apps into life are remarkable. It is a known fact that Windows Phone OS is relatively closed and secure compared to Android & iOS and thus their apps.

In this series of articles, we will discuss some common Windows Mobile Application Penetration Testing tools & techniques. We will begin with the basics of Windows Phone apps and their security and slowly move into assessment techniques. We will begin the series by testing everything on emulators. Later, we will also discuss the concepts on a real device.

How to practice the techniques we learn here

From the Android Application penetration testing series we published, we came to know that many readers are looking for vulnerable apps where they can practice all the vulnerabilities discussed here. As far as I know, there are no test beds available on the Internet to practice Windows Phone application penetration testing. So, we have developed vulnerable Windows Phone apps, which can be used for practicing these concepts while you learn them here.

What platforms will be covered?

We will provide vulnerable apps that run on

  • Windows Phone 8.1
  • Windows 10 Mobile (UWP App)
  • Windows 10 Desktop (UWP App)

We will discuss more details about Windows Phone 8.1 apps and Windows 10 Mobile Applications in a future article of this series.

What do you need to get started with the series?

Though it may look unnecessary for some readers to have a lab set up instructions, I have decided to provide them as these are not as straight as Android. Setting up Windows Emulators need some additional steps shown in the following sections.

According to Microsoft’s documentation for Universal Windows Apps, the following requirements must be satisfied to run an emulator for windows 10 mobile.

  • Hardware-assisted virtualization.
  • Second Level Address Translation (SLAT).
  • Hardware-based Data Execution Prevention (DEP).
  • Windows 8 or higher (Windows 10 strongly recommended)
  • 64-bit
  • Pro edition or higher
  • 4 GB RAM or more

The following is the setup I have while writing these articles and it is recommended to have the same with you. Both Windows Phone 8.1 apps and Windows 10 apps are tested using this setup.

  1. Windows 10 Pro. Yes, you need to pay for it. J

Note: Windows 10 Pro is required to run Windows Phone Emulators. If you consider practicing the techniques on a real device, you may skip this section.

To run Windows Phone emulators, you need to make sure that Hyper-V is enabled on your Windows 10 machine.

Hyper-V support requires Windows 10 Pro. Windows 10 Home doesn’t support Hyper-V.

Assuming that you have Windows 10 Pro, make sure that Virtualization is enabled in BIOS settings as shown in the figure below.

To know more information about BIOS settings for emulators, please follow the URL here.

Now, search for Turn Windows features on or off as shown in the figure below and open it.

Now, select Hyper-V, and it’s subsections as shown in the figure below.

Now, a restart is required on the machine for the changes to take effect and this will enable Hyper-V on your machine.

2. Visual Studio

Setting up a development environment is the recommended way while learning any application penetration testing concepts. Visual Studio is the IDE used in most of the app development associated with Microsoft Technologies. Download Microsoft Visual Studio Community 2015 and install it.

Ethical Hacking Training – Resources (InfoSec)

We can use Visual Studio for loading the source code of the applications being tested when you are given with the source code.

3. Windows Phone SDKs and Emulators

After installing Visual Studio, we need to install SDKs and emulators needed for Windows Phone 8.1 and Universal Windows Platform App development.

This can be done by navigating to Control Panel | Uninstall a program.

Next, choose Microsoft Visual Studio Community 2015 and click Change | Modify.

Next, select the features to be updated as shown in the figure below.

Click UPDATE and wait till the selected features are added to Visual Studio.

4. Vulnerable Apps

Lastly, we need vulnerable apps for practicing the concepts. All the Apps we use in this series will be provided to the readers. We will also see the App installation instructions later in this series.

Conclusion:

In this article, we have covered the introduction and background required to start learning Windows Mobile Application Penetration Testing. We have also seen the requirements for setting up Windows Phone 8.1 emulators as well as Windows 10 mobile emulators.

References:

  1. https://en.wikipedia.org/wiki/Windows_10_Mobile
  2. https://en.wikipedia.org/wiki/Windows_Phone_8.1