Home APPS Why Are Mobile Apps So Insecure?

Why Are Mobile Apps So Insecure?

Mobile security is at the top of many companies’ concerns these days – and it’s not surprising why:

Everyone uses mobile apps. So do your employees. Unfortunately, way too many apps have vulnerabilities and flaws that can potentially put data on the phone at risk (as well as the server-side applications and data).

A report by Ponemon found the average cost of a data breach is $3.86 million. This can be an expensive hit to organizations of all sizes (larger organizations frequently have exposures greater than this).

So what are mobile apps most commonly vulnerable to?

Top 9 Vulnerabilities Of Mobile Apps

Here are the top 9 most common vulnerabilities of mobile apps that you should be aware of:

1. Insecure Server-Side Controls

All mobile apps interact with online/remote services. One of the most common mistakes developers make is to trust their own application data. They think that calls to the back end services from the phone are safe and trusted. This is not true.

Attackers have complete access to their own mobile devices and application data.

What does that mean?

That attackers can input malicious data into the mobile application and potentially gain access to backend API services or sensitive controls of the mobile app.

What leads to insecure server-side controls?

There are several root causes including:

  • Insufficient security budget
  • Rush to market
  • Lack of security knowledge
  • Prioritizing easy access to frameworks instead of security
  • Assuming that the mobile OS is completely responsible for maintaining security

To protect your mobile app from attacks due to insecure server-side controls, never trust inputs to a backend API service, even if they come from your application.

Why?

Attackers can easily communicate with the backend and craft malicious data. All data and requests coming from the mobile device should be treated as untrusted, must be validated, and must be sanitized.

2. Insecure Data Storage

Often, developers assume that malware or users will not have access to the sensitive data stored on the client-side or a mobile device’s file system.

However, file systems on mobile devices are not always trusted. Methods such as jailbreaking or rooting the mobile device can circumvent encryption protections. Also, depending on how data is stored and how that storage is configured, it may be exposed.

Many attacks may originate as a result of insecure data storage, including identity theft, unavailability of data, policy violation (e.g., PCI), loss of data, and in some cases, ransomware attacks.

Valuable data stored on a mobile application can include usernames, passwords, authentication tokens, session IDs, cookies, personal information of the user, debug information, cached data, etc.

To protect your app, avoid storing sensitive data on the phone.

Further, if client-side data storage is required, ensure the data is encrypted using an encryption key that is securely derived from the user’s login credentials. This helps ensure that data stored can only be accessed upon successfully entering the correct credentials.

3. Insufficient Transport Layer Protection

Typically, when a mobile app is created, the app communicates with a server-side application. For example, a bank mobile application will communicate with an application at the bank that processes transactions, receives check images, etc. When this data is exchanged, it will go over a network.

Is it secure?

If the mobile app is designed poorly, attackers could use techniques to view sensitive data while it is traversing in the network. This sensitive data could be passwords, social security numbers, credit card details, and more.

Communication from the app to the server-side app MUST be over TLS (Transport Layer Security). Additionally, the app should pin the certificate to ensure that no one is attempting to intercept and “man-in-the-middle” your communications to the server.

Basically, pinning ensures the mobile app is talking to the correct server application. Additionally, your server applications must be configured to only use the strongest encryption algorithms, protocols, key lengths, and modes of encryption.

4. Poor Authentication And Authorization

Authentication and authorization are two primary security controls that help organizations protect their data and systems.

Weak authentication and authorization can allow an attacker to execute functions within the mobile app that cause data leakage, security breaches, or other severe cyberattacks.

Most mobile apps utilize a single mobile identifier, so that once a mobile device has been registered and authenticated with the back end, the application assumes it doesn’t have to re-authenticate as it is already a trusted device.

However, these identifiers can sometimes be discovered and used to have the attacker perform acts in the name of the victim whose identifier has been exposed.

How can you prevent attacks due to poor authentication and authorization?

You need to find these issues before the attacker does. Utilize security experts to make sure you have strong authentication and authorization controls. This should be done for standard user privileges and is even more important for privileged users (admins).

You should also implement two-factor or multifactor authentication (2FA/MFA) wherein mobile users have to authenticate themselves with two modes of authentication (something you know [passwords], something you have [security tokens], something you are [biometrics]).

5. Unintended Data Leakage

Mobile apps often lead to unintended data leakage. Attackers leverage mobile apps with weak security controls or security vulnerabilities to gain access to users’ sensitive data such as their personal details, credit card information, social security numbers, passwords, etc.

A common example of unintended data leakage in mobile apps is when users grant access and broad permissions to “riskware” apps to access their data.

Riskware apps are legitimate apps that were not designed for malicious activities, but if exploited by attackers – to modify, edit, delete, copy, or distribute data – can disrupt the performance of the application.

Other than riskware apps, attackers could also mimic legitimate apps and once a user downloads the app, they can prompt the user for permission to access their data.

How can you avoid unintended data leakage?

Threat model your OS, frameworks, platforms, to see how they handle the following types of features:

  • Keyboard Press Caching
  • URL Caching
  • Application Backgrounding
  • Analytics sent to third-parties
  • Copy/Paste Buffer Caching

Monitor your default configuration and apply necessary mitigation controls to avoid unintended data leakage.

6. Client-Side Injection

Client-side injection is when data is inserted in the mobile app that leads to multiple types of injection attacks such as SQL injection, XML injection, javascript injection, command injection, etc.

Like regular data, malicious data is also processed by the mobile app’s underlying framework. Then, if the framework interprets the data as executable, the malicious code is executed. These inputs are frequently at the API layer communicating with the server-side application.

Typically, these malicious codes steal sensitive data such as session cookies, passwords, personally identifiable information, etc. Hence, a client-side injection attack could lead to identity theft, fraud, and privacy violations.

How can you prevent client-side injections?

When designing queries for SQL, make sure that data supplied by the user is passed to a parameterized query. Typically, malicious code often includes “%@” instead of an appropriate parameterized query specifier such as “?”.

To prevent XSS injection attacks, ensure that all UIWebView calls only execute validated input data. Apply filters for malicious characters, use a whitelisting process rather than blacklisting before rendering.

In short, validate and encode all untrusted data prior to using.

7. Broken Cryptography

Broken cryptography takes place when developers fail to implement strong encryption or use weak encryption algorithms.

In the first case, developers use insecure algorithms, which have shown significant security weaknesses or are not effective for modern security requirements. These include:

  • MD4
  • MD5
  • RC2

Alternatively, developers may use the same encryption key for all purposes, may not securely store the encryption keys, they may use insecure key lengths, re-use initialization vectors, etc.

There are many ways that cryptography can be broken. Have a security expert review your code to make sure that you are using encryption safely.

8. Security Decisions via Untrusted Inputs

Often, developers use hidden values and fields or hidden functionalities to differentiate between high-level users and low-level users. Hackers may intercept web service calls and tamper with these sensitive functionalities.

Poor or weak implementation of such hidden fields or functionalities can lead to improper app behavior, granting higher-level privileges to lower-level users or attackers. Attackers can bypass security mechanisms and gain access to users’ personal information and other confidential data on the application.

9. Improper Session Handling

To ensure a smoother workflow and ease-of-access for mobile device users, almost all apps use tokens, which enable users to perform multiple actions without re-authenticating their identity.

Secure apps generate new tokens with each session or access attempt and keep it confidential.

What is the impact of improper session handling?

Improper session handling can result in an adversary gaining access to the session tokens and impersonating the user by submitting the token to the backend server for transactions.

Often this occurs when the user has navigated away from the website or the app. Improper session handling could result in information theft, identity theft, fraud, or business interruption.

To protect your users and app from improper session handling attacks, ensure that you create, maintain, and destroy session tokens properly during the lifecycle of a user’s session.

Final Thoughts

Just like web application security, mobile app security is also crucial for businesses. The times when one could overlook the importance of mobile app security are far gone. In today’s highly interconnected world, attackers are constantly looking for ways to attack users and companies by exploiting vulnerabilities. Now that you know the top 9 threats to mobile apps, ensure that you develop a secure mobile application.

Aaron Cure
Aaron Cure is the Principal Security Consultant at Cypress Data Defense and an instructor and contributing author for the Dev544 Secure Coding in .NET course.  After 10 years in the U.S. Army, I decided to switch my focus to developing security tools and performing secure code reviews, penetration testing, static source code analysis, and security research.

RECENT POSTS

How To Track My Boyfriend’s Android Phone In 2020

Looking forward to one of the best solutions when it comes to tracking your boyfriend’s android phone in 2020 is easy if you have...

How To Delete Your Twitter Account (And Keep Your Tweets)

We in this article, we will tell you how to delete your Twitter account, and how to back up your tweets. The idea of ​​leaving...

Bored During The Lockdown? Log In To Instagram And Show Your Passion To The World

It won't be wrong to say coronavirus brought the entire world to a halt. Lockdowns were imposed in several countries around the world, which...

Which Internet Providers Offer Good Services?

The best internet service providers depend on multiple factors including speed, price, data limits, and customer care services they offer. Your location is also...

How To Delete Your Facebook Account (And Keep Your Data)

When you're ready to quit Facebook, be sure to collect the wanted data before closing the door. Given the large amount of data that...

Need To Convert From PSD To Angular – Know The Reasons

Hello, everyone! How is your life? I hope you are very good. So, today I want to represent to you a very useful article:...