Software Test Attacks to Break Mobile and Embedded Devices
Год: 2014
Автор: Jon Duncan Hagar
Жанр: Тестирование ПО
Издательство: Chapman and Hall/CRC
ISBN: 978-1-4665-7531-8
Язык: Английский
Формат: PDF
Качество: Изначально компьютерное (eBook)
Количество страниц: 317
Описание:
Using a mix-and-match approach, Software Test Attacks to Break Mobile and Embedded Devices presents an attack basis for testing mobile and embedded systems. Designed for testers working in the ever-expanding world of "smart" devices driven by software, the book focuses on attack-based testing that can be used by individuals and teams. The numerous test attacks show you when a software product does not work (i.e., has bugs) and provide you with information about the software product under test.
The book guides you step by step starting with the basics. It explains patterns and techniques ranging from simple mind mapping to sophisticated test labs. For traditional testers moving into the mobile and embedded area, the book bridges the gap between IT and mobile/embedded system testing. It illustrates how to apply both traditional and new approaches. For those working with mobile/embedded systems without an extensive background in testing, the book brings together testing ideas, techniques, and solutions that are immediately applicable to testing smart and mobile devices.
Оглавление
Chapter 1 Setting the Mobile and Embedded Framework 1
OBJECTIVES OF TESTING MOBILE AND EMBEDDED SOFTWARE SYSTEMS 1
WHAT IS EMBEDDED SOFTWARE? 2
WHAT ARE “SMART” HANDHELD AND MOBILE SYSTEMS? 3
WHY MOBILE AND EMBEDDED ATTACKS? 5
FRAMEWORK FOR ATTACKS 6
BEGINNING YOUR TEST STRATEGY 6
ATTACKS ON MOBILE AND EMBEDDED SOFTWARE 8
IF YOU ARE NEW TO TESTING 9
AN ENLIGHTENED TESTER MAKES A BETTER TESTER 10
Chapter 2 Developer Attacks: Taking the Code Head On 13
ATTACK 1: STATIC CODE ANALYSIS 14
ATTACK 2: FINDING WHITE-BOX DATA COMPUTATION BUGS 21
ATTACK 3: WHITE-BOX STRUCTURAL LOGIC FLOW COVERAGE 25
TEST COVERAGE CONCEPTS FOR WHITE-BOX STRUCTURAL TESTING 28
NOTE OF CONCERN IN MOBILE AND EMBEDDED ENVIRONMENTS 29
Chapter 3 Control System Attacks 33
ATTACK 4: FINDING HARDWARE–SYSTEM UNHANDLED USES IN SOFTWARE 33
ATTACK 5: HARDWARE-TO-SOFTWARE AND SOFTWARE-TO-HARDWARE SIGNAL INTERFACE BUGS 39
ATTACK 6: LONG-DURATION CONTROL ATTACK RUNS 45
ATTACK 7: BREAKING SOFTWARE LOGIC AND/OR CONTROL LAWS 49
ATTACK 8: FORCING THE UNUSUAL BUG CASES 54
Chapter 4 Hardware Software Attacks 59
ATTACK 9: BREAKING SOFTWARE WITH HARDWARE AND SYSTEM OPERATIONS 59
SUB-ATTACK 9.1: BREAKING BATTERY POWER 65
ATTACK 10: FINDING BUGS IN HARDWARE–SOFTWARE COMMUNICATIONS 66
ATTACK 11: BREAKING SOFTWARE ERROR RECOVERY 69
ATTACK 12: INTERFACE AND INTEGRATION TESTING 74
SUB-ATTACK 12.1: CONFIGURATION INTEGRATION EVALUATION 80
ATTACK 13: FINDING PROBLEMS IN SOFTWARE–SYSTEM FAULT TOLERANCE 80
Chapter 5 Mobile and Embedded Software Attacks 89
ATTACK 14: BREAKING DIGITAL SOFTWARE COMMUNICATIONS 89
ATTACK 15: FINDING BUGS IN THE DATA 94
ATTACK 16: BUGS IN SYSTEM-SOFTWARE COMPUTATION 97
ATTACK 17: USING SIMULATION AND STIMULATION TO DRIVE SOFTWARE ATTACKS 101
Chapter 6 Time Attacks: “It’s about Time” 107
ATTACK 18: BUGS IN TIMING INTERRUPTS AND PRIORITY INVERSIONS 108
STATE MODELING EXAMPLE 114
ATTACK 19: FINDING TIME-RELATED BUGS 116
ATTACK 20: TIME-RELATED SCENARIOS, STORIES, AND TOURS 121
ATTACK 21: PERFORMANCE TESTING INTRODUCTION 125
SUPPORTING CONCEPTS 139
COMPLETING AND REPORTING THE PERFORMANCE ATTACK 140
WRAPPING UP 140
Chapter 7 Human User Interface Attacks: “The Limited (and Unlimited) User Interface” 143
HOW TO GET STARTED—THE UI 144
ATTACK 22: FINDING SUPPORTING (USER) DOCUMENTATION PROBLEMS 146
SUB-ATTACK 22.1: CONFIRMING INSTALL-ABILITY 149
ATTACK 23: FINDING MISSING OR WRONG ALARMS 149
ATTACK 24: FINDING BUGS IN HELP FILES 153
Chapter 8 Smart and/or Mobile Phone Attacks 159
GENERAL NOTES AND ATTACK CONCEPTS APPLICABLE TO MOST MOBILE–EMBEDDED DEVICES 159
ATTACK 25: FINDING BUGS IN APPS 161
ATTACK 26: TESTING MOBILE AND EMBEDDED GAMES 165
ATTACK 27: ATTACKING APP–CLOUD DEPENDENCIES 170
Chapter 9 Mobile/Embedded Security 177
THE CURRENT SITUATION 178
REUSING SECURITY ATTACKS 178
ATTACK 28: PENETRATION ATTACK TEST 180
ATTACK 28.1: PENETRATION SUB-ATTACKS: AUTHENTICATION—PASSWORD ATTACK 186
ATTACK 28.2: SUB-ATTACK FUZZ TEST 188
ATTACK 29: INFORMATION THEFT—STEALING DEVICE DATA 189
ATTACK 29.1: SUB-ATTACK—IDENTITY SOCIAL ENGINEERING 193
ATTACK 30: SPOOFING ATTACKS 194
ATTACK 30.1: LOCATION AND/OR USER PROFILE SPOOF SUB-ATTACK 199
ATTACK 30.2: GPS SPOOF SUB-ATTACK 200
ATTACK 31: ATTACKING VIRUSES ON THE RUN IN FACTORIES OR PLCS 201
Chapter 10 Generic Attacks 209
ATTACK 32: USING COMBINATORIAL TESTS 209
ATTACK 33: ATTACKING FUNCTIONAL BUGS 215
Chapter 11 Mobile and Embedded System Labs 221
INTRODUCTION TO LABS 221
TO START 222
TEST FACILITIES 223
WHY SHOULD A TESTER CARE? 224
WHAT PROBLEM DOES A TEST LAB SOLVE? 225
STAGED EVOLUTION OF A TEST LAB 227
SIMULATION ENVIRONMENTS 227
PROTOTYPE AND EARLY DEVELOPMENT LABS 228
DEVELOPMENT SUPPORT TEST LABS 228
INTEGRATION LABS 230
PRE-PRODUCT AND PRODUCT RELEASE (FULL TEST LAB) 230
FIELD LABS 230
OTHER PLACES LABS CAN BE REALIZED 232
DEVELOPING LABS: A PROJECT INSIDE OF A PROJECT 233
PLANNING LABS 233
REQUIREMENT CONSIDERATIONS FOR LABS 234
FUNCTIONAL ELEMENTS FOR A DEVELOPER SUPPORT LAB 234
FUNCTIONAL ELEMENTS FOR A SOFTWARE TEST LAB 235
TEST LAB DESIGN FACTORS 236
LAB IMPLEMENTATION 238
LAB CERTIFICATION 238
OPERATIONS AND MAINTENANCE IN THE LAB 239
LAB LESSONS LEARNED 240
AUTOMATION CONCEPTS FOR TEST LABS 241
TOOLING TO SUPPORT LAB WORK 241
TEST DATA SET-UP 243
TEST EXECUTION: FOR DEVELOPER TESTING 244
TEST EXECUTION: GENERAL 245
PRODUCT AND SECURITY ANALYSIS TOOLS 247
TOOLS FOR THE LAB TEST RESULTS RECORDING 247
PERFORMANCE ATTACK TOOLING 248
BASIC AND GENERIC TEST SUPPORT TOOLS 250
AUTOMATION: TEST ORACLES FOR THE LAB USING MODELING TOOLS 251
SIMULATION, STIMULATION, AND MODELING IN THE LAB TEST BED 253
CONTINUOUS REAL-TIME, CLOSED-LOOP SIMULATIONS TO SUPPORT LAB TEST ENVIRONMENTS 256
KEYWORD-DRIVEN TEST MODELS AND ENVIRONMENTS 259
DATA COLLECTION, ANALYSIS, AND REPORTING 260
POSTTEST DATA ANALYSIS 262
POSTTEST DATA REPORTING 265
WRAP UP: N-VERSION TESTING PROBLEMS IN LABS AND MODELING 267
FINAL THOUGHTS: INDEPENDENCE, BLIND SPOTS, AND TEST LAB STAFFING 268
Chapter 12 Some Parting Advice 273
ARE WE THERE YET? 273
WILL YOU GET STARTED TODAY? 273
ADVICE FOR THE “NEVER EVER” TESTER 273
BUG DATABASE, TAXONOMIES, AND LEARNING FROM YOUR HISTORY 274
LESSONS LEARNED AND RETROSPECTIVES 275
IMPLEMENTING SOFTWARE ATTACK PLANNING 275
REGRESSION AND RETEST 277
WHERE DO YOU GO FROM HERE? 278
