Features of Human Crest's Vulnerability Assessment

We have collaboration with GMO Cybersecurity by Ierae, Inc., a company specialized in vulnerability assessments using the world's leading analysis technology, to provide hybrid security assessment of Android apps, iOS apps, web apps, networks and IoT devices through both manual and tool-based approaches.
By integrating the handling of both product verification and vulnerability assessment, we can collectively manage information and achieving high quality and high levels of security at the same time.

Vulnerability Assessment Service Options

❶ Web app vulnerability assessment

Hybrid assessment of tools and manuals.
High level of reliability and security, backed by the extensive experience of assessing over 5000 apps.

• Perform assessment of web apps developed in Java, PHP, Perl, Ruby, etc.
• Perform pseudo attacks over the network(i.e. input illegal values, falsified requests, insert illegal code, etc.), to check for vulnerabilities in design, implementation, logic, etc. that could lead to unauthorized access, info leaks, or service exploits.
• I/O processing, authentication/authorization, session management, web server configuration, Web 2.0 and more.

❷ iOS & Android app vulnerability assessment

We conduct reverse engineering using advanced analysis techniques to assess both iOS and Android apps.
We can also handle Windows and Mac applications.

【Android app assessment】
• Check access restriction for data sharing function, check inter-app communication
• WebView vulnerabilities
• Device data protection
• Obfuscation and stubbing check
  (whether the .NET source code is hidden by the program using Unity)

【iOS app assessment】
• Check log output, check inter-app communication
• WebView vulnerabilities
• Safeguards against attacks that use iFunbox
• Obfuscation and stubbing check
  (whether the .NET source code is hidden by the program using Unity)

❸ Network Assessment

While imposing load, as little as possible, on the system in operation, we check the server OS and services, to identify whether risks exist in the assessment target.
We can also provide penetration testing.

• Assess network-based service servers, such as DNS servers, mail servers and directory servers
• Assess network devices such as routers, firewalls and VPN devices
• Penetration testing

【Penetration Testing】
We have added penetration testing in our assessment options, which diagnoses vulnerabilities by executing a simulated cyber attack (equivalent to a hacker attack).
In addition to our existing assessments of networks and web apps, we also offer even more precise assessments of internal and external server vulnerabilities by performing APT attack tests that deploy custom pseudo-malware.

❹ IoT device vulnerability assessment

A manual assessment of IoT device security issues

• Protocol assessment: Assesses whether it is possible to elicit behaviors that would benefit an attacker by testing abnormal requests according to device-specific protocols, as well as requests that attempt to bypass authorization
• DoS Testing: Assess whether sending anomalous content and a large amount of requests to a device can hamper its operation
• Firmware testing: Examine the device's firmware update file and update process to determine whether secret logic and keys can be analyzed and whether unauthorized uploads (such as modified firmware) can be applied
• Other: Assess whether any attack can exploit the specific characteristics of the device

Service Examples