-
Weak Server-Side Controls
Mobile Internet usage has exceeded fixed Internet access. This is primarily due to the expansion of hybrid and HTML5 mobile applications. Application servers, which serve as the foundation for these applications, must be secured on their own.
A complete compromise of the application server may be caused by flaws like injections, unsecured direct object references, insecure communication, and others. Once hackers have taken control of the compromised servers, they can push malicious content to all application users while also compromising user devices.
-
Insecure Data Storage
As the name implies, Insecure Data Storage is concerned with the security of data in storage. Mobile applications are used for a wide range of tasks, including gaming, fitness tracking, online banking, stock trading, and so on, and the majority of the data used by these applications is stored on the device itself in SQLite files, XML data stores, log files, and so on. Alternatively, they are sent to cloud storage.
These applications may store sensitive data ranging from location information to bank account information. Application programming interfaces (APIs) that handle storage of data must use encryption algorithms so that a malicious user with direct access to these data stores through theft or malware is unable to decipher the sensitive information stored in them.
-
Insufficient Transport Layer Protection
All hybrid and HTML 5 apps use a client-server architecture, with an emphasis on data in motion because the data must travel through various channels and is vulnerable to eavesdropping and tampering by hackers. SSL/TLS controls, which enforce data confidentiality and integrity, must be verified for proper deployments on the communication channel between the mobile apps and its server.
-
Unintended Data Leakage
Certain mobile application modules may store sensitive user data in areas where it can be accessed by other applications or even malware. These features may be present to improve usability or user experience, but they may have negative long-term consequences.
Malicious actors can use actions such as OS data caching, key press logging, copy/paste buffer caching, and implementations of web beacons or analytics cookies for advertisement delivery to obtain information about victims.
-
Poor Authorization and Authentication
Because mobile devices are the most personal devices, developers take advantage of this by storing critical data such as credentials locally on the device and developing specific mechanisms to authenticate and authorize users locally for the services that the user is requesting via the application.
If these mechanisms are not well developed, hackers may be capable of bypassing these controls and perform unauthorized actions. Because the code is available, they can perform binary attacks and recompile it to directly access authorized content.
-
Broken Cryptography
This relates to ineffective data protection controls. The use of weak cryptographic algorithms that can be cracked, such as RC2, MD5, and others, will result in encryption failure.
Poor encryption key management, such as storing the key in locations accessible to other apps, or the use of a guessable key generation process, will also cause the cryptographic approaches to fail.
-
Client-Side Injection
Injection vulnerabilities are caused by faulty inputs, which result in unwanted events such as database query changes, command execution, and so on. Malformed inputs in mobile applications can pose a major hazard both at the local application level and on the server side.
Injections at the local application level, which primarily target data stores, may result in problems such as access to premium material that is restricted to trial users or file inclusions, which may lead to the abuse of functionalities such as Messaging.
-
Security Decisions via Untrusted Inputs
Some functionalities, such as the use of hidden variables to check authorization status, can be bypassed by interfering with them during transit via web service calls or inter-process communication calls. This may result in privilege escalation and undesired mobile application behavior.
-
Improper Session Handling
On successful authentication with the mobile application, the application server returns the session token. These session tokens are utilized by mobile applications to make service requests.
If these session tokens remain active for an extended period of time and attackers can obtain them through malware or theft, and the user account can be compromised.
-
Lack of Binary Protections
Everyone has access to the source code for mobile applications. An attacker can reverse engineer the application and install malicious code components, which are then recompiled.
If a user installs this altered software, they will be vulnerable to data theft and become victims of unwanted activities. Most apps do not have features such as checksum controls, which aid in determining whether or not the application has been tampered with or not.
