COMPARATIVE ANALYSIS OF ANDROID-BASED ONLINE TRANSPORTATION APPLICATION SECURITY USING MOBILE SECURITY FRAMEWORK (MOBSF)

Triyawan Bagus Subakja
Mona Fronita
Syaifullah Syaifullah
Tengku Khairil Ahsyar
Syafril Siregar


DOI: https://doi.org/10.29100/jipi.v10i2.6185

Abstract


Online transportation is a service provided over the internet, representing a technological innovation that has significantly facilitated travel for Indonesians. These applications have gained widespread adoption in Indonesia, serving as alternatives to conventional transport modes like taxis and traditional motorcycle taxis. They offer convenience and speed in booking rides, along with secure transactions through digital payment systems. Despite the user-friendly experience and advantages offered by these applications, their security cannot be overlooked. The increasing accessibility of Android-based online transportation applications has made them a prime target for malicious actors ("Crackers") who may exploit vulnerabilities for nefarious purposes. This research aims to identify security vulnerabilities and compare the security found in Android-based online transportation applications. The researcher utilized the Mobile Security Framework (MobSF) to conduct static security analysis focusing on parameters such as dangerous permissions, weak cryptography, root detection, SSL bypass, and domain malware checks. The security assessments of Gojek, Maxim, and Grab revealed moderate security risks. Gojek scored 44/100, Maxim 47/100, and Grab 50/100 in terms of security ratings. All three applications were found to have vulnerabilities related to dangerous permissions and weak cryptography. Specifically, Maxim was also susceptible to SSL bypass attacks. None of the applications had implemented root detection, but their domain malware checks were deemed satisfactory.

Keywords


Android; MobSF; Online Transportation; Security; Static Analysis

Full Text:

PDF

Article Metrics :

References


I. Himawan, K. Septianzah, and I. Setiadi, “Analisis Keamanan Informasi Malware Terhadap Aplikasi Apk Dengan Metode Static Analysis Menggunakan Mobsf,” JRKT (Jurnal Rekayasa Komputasi Ter., vol. 2, no. 02, pp. 122–127, 2022, doi: 10.30998/jrkt.v2i02.6734.

A. Apriliani, M. Budhiluhoer, A. Jamaludin, and K. Prihandani, “Systematic Literature Review Kepuasan Pelanggan terhadap Jasa Transportasi Online,” Systematics, vol. 2, no. 1, p. 12, 2020, doi: 10.35706/sys.v2i1.3530.

R. Renaldi and M. Pradana, “SEIKO : Journal of Management & Business Analisis Ekspektasi Penggunaan Aplikasi Transportasi Online Menggunakan Pendekatan Importance Performance Analysis (IPA),” SEIKO J. Manag. Bus., vol. 6, no. 1, pp. 887–897, 2023, doi: 10.37531/sejaman.v6i1.4114.

A. A. Putra, O. D. Nurhayati, and I. P. Windasari, “Perencanaan dan Implementasi Information Security Management System Menggunakan Framework ISO/IEC 20071,” J. Teknol. dan Sist. Komput., vol. 4, no. 1, p. 60, 2016, doi: 10.14710/jtsiskom.4.1.2016.60-66.

N. Anwar, S. A. Akbar, A. Azhari, and I. Suryanto, “Ekstraksi Logis Forensik Mobile pada Aplikasi E-Commerce Android,” Mob. Forensics, vol. 2, no. 1, pp. 1–10, 2020, doi: 10.12928/mf.v2i1.1791.

F. Awanda Alviansyah and E. Ramadhani, “Implementasi Dynamic Application Security Testing pada Aplikasi Berbasis Android,” Automata, vol. 2, no. 1, pp. 85–90, 2021.

C. Hanifurohman and D. D. Hutagalung, “Analisis Statis Menggunakan Mobile Security Framework Untuk Pengujian Keamanan Aplikasi Mobile E-Commerce Berbasis Android,” Sebatik, vol. 24, no. 1, pp. 22–28, 2020, doi: 10.46984/sebatik.v24i1.920.

F. Nurindahsari and B. Parga Zen, “Analisis Statik Keamanan Aplikasi Video Streaming Berbasis Android Menggunakan Mobile Security Framework (Mobsf),” Cyber Secur. dan Forensik Digit., vol. 4, no. 2, pp. 63–80, 2022, doi: 10.14421/csecurity.2021.4.2.3373.

M. H. Rumlus and H. Hartadi, “Kebijakan Penanggulangan Pencurian Data Pribadi dalam Media Elektronik,” J. HAM, vol. 11, no. 2, p. 285, 2020, doi: 10.30641/ham.2020.11.285-299.

P. Edward and A. N. S. Haprasari, “Analisi Kapabilitas SIPKD BKD Kota Salatiga,” Aiti, vol. 16, no. 1, pp. 65–87, 2019, doi: 10.24246/aiti.v16i1.65-87.

K. N. Afrina, M. Irwan, and P. Nasution, “Perlindungan Terhadap Penyalahgunaan Data Pribadi Dalam Layanan Transportasi Berbasis Online,” IJM Indones. J. Multidiscip., vol. 1, no. 2, pp. 834–840, 2023.

A. Kartono, A. Sularsa, and S. J. I. Ismail, “Membangun Sistem Pengujian Keamanan Aplikasi Android Menggunakan Mobsf,” eProceedings …, vol. 5, no. 1, pp. 146–151, 2019, [Online]. Available: https://openlibrarypublications.telkomuniversity.ac.id/index.php/appliedscience/article/view/8563%0Ahttps://openlibrarypublications.telkomuniversity.ac.id/index.php/appliedscience/article/viewFile/8563/8431

P. Studi, S. Informasi, F. Sains, D. A. N. Teknologi, U. Islam, and N. Syarif, “2023 m / 1444 h,” 2023.

C. Anwar, C. Herli Sumerli A, N. Rahayu, and K. Kraugusteeliana, “The Application of Mobile Security Framework (MOBSF) and Mobile Application Security Testing Guide to Ensure the Security in Mobile Commerce Applications,” J. Inf. Syst. Technol., vol. 5, no. 2, pp. 97–102, 2023, doi: 10.37034/jsisfotek.v5i1.231.

H. Shahriar, M. Arabin Talukder, and M. Saiful Islam, “An Exploratory Analysis of Mobile Security Tools,” KSU Conf. Cybersecurity Educ. Res. Pract., 2019, [Online]. Available: https://digitalcommons.kennesaw.edu/ccerphttps://digitalcommons.kennesaw.edu/ccerp/2019/research/4

D. Alqausar, “Tools Penetration Testing Android Terbaik untuk Mendeteksi Kerentanan Aplikasi Mobile,” Biztech.Proxsisgroup.Com. 2024. [Online]. Available: https://biztech.proxsisgroup.com/tools-penetration-testing-android-terbaik-untuk-mendeteksi-kerentanan-aplikasi-mobile/

F. Kurniawan, A. Kusyanti, and H. Nurwarsito, “Analisis dan Implementasi Algoritma SHA-1 dan SHA-3 pada Sistem Autentikasi Garuda Training Cost,” J. Pengemb. Teknol. Inf. dan Ilmu Komput., vol. 1, no. 9, pp. 803–812, 2017, [Online]. Available: http://j-ptiik.ub.ac.id/index.php/j-ptiik/article/view/247

R. M. Wahyudi, “Mengimplementasikan SSL/TLS pada Web Server Apache di dalam Jaringan Internal Praktikum untuk Pengembangan Web Server,” J. Majemuk, vol. 3, no. 1, pp. 13–31, 2024, [Online]. Available: https://jurnalilmiah.org/journal/index.php/majemuk/article/view/655

D. Prayama, Yuhefizar, and Amelia Yolanda, “Protokol HTTPS, Apakah Benar-benar Aman?,” J. Appl. Comput. Sci. Technol., vol. 2, no. 1, pp. 7–11, 2021, doi: 10.52158/jacost.v2i1.118.

S. Sinambela, A. R. Pangestu, and R. Feriyanto, “Analisis Aplikasi Malware pada Android dengan Metode Statik,” J. Ilm. Ilk. - Ilmu Komput. Inform., vol. 3, no. 2, pp. 88–94, 2020, doi: 10.47324/ilkominfo.v3i2.101.