CAS-003 · Question #500
An analyst is investigating behavior on a corporate-owned, corporate-managed mobile device with application whitelisting enabled, based on a name string. The employee to whom the device is assigned…
The correct answer is A. Reverse engineer the application binary. The best thing to do would be analyzing the application running on the mobile, to verify if it is really malicious. This would be done by reverse engineering the .apk (option A), since you don’t have this malicious app source code.
Question
An analyst is investigating behavior on a corporate-owned, corporate-managed mobile device with application whitelisting enabled, based on a name string. The employee to whom the device is assigned reports the approved email client is displaying warning messages that can launch browser windows and is adding unrecognized email addresses to the "compose" window. Which of the following would provide the analyst the BEST chance of understanding and characterizing the malicious behavior?
Options
- AReverse engineer the application binary.
- BPerform static code analysis on the source code.
- CAnalyze the device firmware via the JTAG interface.
- DChange to a whitelist that uses cryptographic hashing.
- EPenetration test the mobile application.
How the community answered
(32 responses)- A56% (18)
- B25% (8)
- C9% (3)
- D6% (2)
- E3% (1)
Explanation
The best thing to do would be analyzing the application running on the mobile, to verify if it is really malicious. This would be done by reverse engineering the .apk (option A), since you don’t have this malicious app source code.
Topics
Community Discussion
No community discussion yet for this question.