OWASP: Top 10 Mobile vulnerabilities

Mobile applications have become an integral part of our daily lives, offering convenience, functionality, and entertainment right at our fingertips. As developers strive to create innovative and feature-rich apps, it is essential to prioritise security and protect against common vulnerabilities.

Whether you are a developer, a security professional, or an app user concerned about data privacy, this article will provide valuable insights to navigate the complex landscape of mobile app security.

By understanding these vulnerabilities, developers can fortify their apps, safeguard user information, and build trust among their user base.

What is OWASP?

OWASP (Open Web Application Security Project) is a non-profit organisation that focuses on improving the security of software and web applications. OWASP provides resources, tools, and knowledge to help organisations and individuals understand and address security vulnerabilities in their applications.

The mission of OWASP is to make software security visible, enabling individuals and organisations to make informed decisions regarding the security of their applications. They achieve this through various initiatives, including community-driven projects, documentation, guidelines, training, and events.

OWASP is well-known for its “OWASP Top 10” project, which identifies and highlights the most critical web application security risks. The OWASP Top 10 serves as a reference for developers, security professionals, and organisations to prioritise and address common vulnerabilities.

OWASP plays a crucial role in advocating for application security and fostering collaboration among security professionals, developers, and organisations to build more secure software and protect against emerging threats.

Throughout the following sections, we will cover each vulnerability in detail, explaining its significance and providing practical recommendations for mitigation. We will discuss the importance of secure coding practices, proper authentication and authorisation mechanisms, encryption, communication security, and more.

OWASP Vulnerabilities

These vulnerabilities highlight the most common security risks found in mobile applications. Here is a brief explanation of these vulnerabilities according to OWASP:

Improper Platform Usage

According to OWASP, this vulnerability encompasses various security issues related to the misuse or improper implementation of platform-specific security features. It includes situations where developers fail to utilise secure storage options, do not implement appropriate encryption algorithms, or neglect to protect sensitive information adequately. Not leveraging platform security features correctly makes apps more susceptible to attacks and data breaches.

To prevent this vulnerability and address the remediation of the server-side features, developers can take the following steps:

Adhere to the recommended practices provided by the platform, such as Android Intent or iOS Keychain, to ensure the secure implementation of features. These guidelines often include security considerations and best practices for protecting user data.
Apply secure coding techniques during mobile app development to mitigate vulnerabilities. This includes properly validating and sanitising user inputs, using parameterised queries to prevent SQL injection, and implementing proper error handling to prevent information leakage.
Perform server-side hardening: Implement security measures on the server side, including the secure configuration of servers, limiting unnecessary services or ports, and regularly patching software and frameworks to address known vulnerabilities.
Prevent unauthorised data sharing between different apps by implementing appropriate data isolation and access controls. Ensure that apps have limited permissions to access sensitive data and restrict inter-app communication to only necessary and trusted sources.
Apply strict file permissions to prevent unauthorised access to sensitive data stored on the server or within the app. Only grant necessary permissions to files and directories and regularly review and update access controls.
Store sensitive data, such as personal information or user credentials, in encrypted form on both the client-side and server side. Implement strong encryption algorithms to protect data at rest and during transmission, and ensure proper key management practices are in place.

Insecure Data Storage

Inadequate data storage security can lead to unauthorised access and compromise of sensitive information. This vulnerability can arise when developers do not encrypt or store data securely on the device. Attackers may exploit this weakness to retrieve or manipulate sensitive data, such as login credentials, personal information, or financial details.

To secure data storage in mobile applications and address the vulnerability of insecure data storage, developers can implement the following measures:

Encrypt sensitive data before storing it on the device. This involves using encryption algorithms to convert the data into an unreadable format. Encryption ensures that if someone gains unauthorised access to the data, they won’t be able to decipher its contents without the decryption key.
Use secure authentication methods to verify the identity of users before granting access to the mobile app. This can include password-based authentication, biometric authentication (fingerprint or face recognition), or two-factor authentication. Ensuring that only authorised users can access the app mitigates the risk of unauthorised access to stored data.
Set appropriate permissions and access controls for storing files in the app. This prevents unauthorised access by other apps or users on the device. By limiting access to specific files or directories, developers can ensure that sensitive data is only accessible to the authorised app.

Insecure Communication

This vulnerability pertains to insecure data transmission between the mobile app and backend servers. It includes situations where apps do not use secure communication protocols, such as HTTPS, or fail to validate server authenticity. Attackers can intercept and manipulate data exchanged between the app and servers, potentially gaining unauthorised access to sensitive information.

To prevent insecure communication in mobile applications and address the vulnerability of insecure communication, developers can implement the following measures:

SSL/TLS certificates establish a secure connection between the mobile app and the server. By obtaining and installing SSL/TLS certificates from trusted certificate authorities (CAs), developers can ensure the communication is encrypted and protected from eavesdropping or interception.
When obtaining SSL/TLS certificates, it is important to use certificates from reputable and trusted authorities. This ensures that the certificates are valid and recognised by popular web browsers and operating systems.
Ensure that the mobile app uses strong encryption protocols and adheres to best practices for secure communication. This includes using the latest versions of encryption algorithms, configuring secure cypher suites, and following recommended guidelines for secure communication implementation.
When sending sensitive data or session tokens from the mobile app to a web service or backend API, ensure the communication is done securely over encrypted channels. This prevents unauthorised access to sensitive information during transmission.
Avoid including session user IDs along with SSL session tokens during communication. This helps prevent potential security risks associated with session hijacking or impersonation.
If possible, encrypt the data before sending it over the SSL/TLS channel. This adds an extra security layer, ensuring that even if the encrypted data is intercepted, it remains unreadable without the decryption key.
It is important to apply SSL/TLS encryption to all transport channels the mobile app uses for transmitting sensitive information. This includes communication between the app and the server and any other third-party services or APIs involved in the data exchange.

Insecure Authentication

Weak or flawed authentication mechanisms can put user accounts and data at risk. This vulnerability may manifest as weak password policies, lack of multi-factor authentication, or inadequate session management. Attackers can exploit these weaknesses to impersonate users, gain unauthorised access, or compromise user accounts.

To prevent insecure authentication in mobile applications and address the vulnerability, developers can implement the following measures:

Implement Multi-Factor Authentication (MFA): MFA adds an extra security layer by requiring users to provide multiple forms of identification, such as a password and a unique verification code sent to their mobile device. This significantly enhances the authentication process and reduces the risk of unauthorised access.

By implementing multi-factor authentication, enforcing strong password policies, aligning security protocols, deploying server-side authentication, avoiding local storage of passwords, utilising encryption for stored data, refraining from persistent authentication, ensuring data availability after successful authentication, cautioning users about the “remember me” option, enforcing device-centric authentication, and protecting against binary attacks, developers can significantly enhance the security of the authentication process in mobile applications.

These measures help mitigate the risk of insecure authentication and ensure that only authorised users gain access to the application’s resources.

Insufficient Cryptography

Inadequate or improper use of cryptography can lead to vulnerabilities in mobile apps. It includes situations where weak encryption algorithms are used, keys are managed poorly, or random number generation is insecure. Attackers can exploit these weaknesses to decrypt sensitive information or bypass security measures.

To prevent insufficient cryptography in mobile applications, developers can follow these measures:

Minimise the amount of sensitive data stored on the user’s device. Instead, consider storing the data on secure servers or utilising encryption techniques to protect the data if local storage is necessary.
The National Institute of Standards and Technology (NIST) provides guidelines and recommendations for cryptographic algorithms. Follow these guidelines to ensure strong and secure cryptographic algorithms that resist attacks.

Insecure Authorisation

Insecure authorisation mechanisms can enable unauthorised access to certain functionalities or sensitive data within an app. This vulnerability can occur due to improper access control checks, insecure direct object references, or insufficient authorisation levels. Attackers may exploit these weaknesses to gain elevated privileges or perform unauthorised actions.

In an example attack scenario for insecure authorisation, a user interacts with a backend REST API by sending an API request with a user ID and an OAuth token. The user includes these credentials as part of the request header, and the application verifies the validity of the bearer token.

However, in this case, the application fails to validate the user ID associated with the bearer token properly. This vulnerability allows the user to manipulate the user ID in the request and gain access to other users’ information submitted through the API.

How to Prevent Insecure Authorisation?

To ensure secure authorisation, avoiding assigning roles and permissions solely based on information received from a mobile device is advisable. Instead, it is crucial to independently authenticate and validate the user’s identity using backend codes.

By implementing this approach, the verification process is conducted separately from the mobile device, adding an extra layer of security and ensuring that only authorised individuals are granted access to sensitive resources or functionalities.

Client Code Quality: This vulnerability focuses on weaknesses in the client-side code of the mobile app. It includes improper input validation, lack of input and output encoding, or poor error handling. These vulnerabilities can be exploited to manipulate the app’s behaviour, inject malicious code, or gain unauthorised access to resources.

To mitigate the risks associated with client code quality, it is essential to take the following steps:

Utilise static code analysis tools: Use static code analysis tools to scan the codebase for potential issues, including security vulnerabilities, coding errors, and performance bottlenecks. These tools help identify and address issues early in the development process.
Maintain consistent code patterns: Establish and adhere to consistent code patterns and conventions across the development team. This promotes code readability and maintainability and reduces the chances of introducing errors or vulnerabilities.
Avoid overly simplistic logic: Avoid using simplistic logic in the code that may be prone to security vulnerabilities. Instead, implement robust and comprehensive logic to handle various scenarios and potential security risks.
Implement multi-factor authentication (MFA): Incorporate multi-factor authentication mechanisms, such as one-time passwords (OTP), biometrics, or hardware tokens, to ensure that users’ identities are verified before granting access to sensitive resources or performing critical operations.
Ensure secure integration of third-party libraries: When using third-party libraries, ensure they come from reliable sources and undergo regular security audits. Keep track of the libraries used and promptly update them with security patches and updates to mitigate any known vulnerabilities.
Regularly test for security issues: Utilise automated security testing tools to identify common vulnerabilities, including buffer overflow, memory leaks, and remote code execution. Regularly perform these tests to identify and address potential security weaknesses in the code.
Enable permission flags on content providers: If your application utilises content providers to share data with other apps, ensure that appropriate permission flags are set to prevent unauthorised access. This ensures that sensitive data is not exposed to unauthorised parties.

Code Tampering

Code tampering vulnerabilities occur when attackers modify the app’s code to bypass security measures or introduce malicious code. Attackers may decompile, modify, or repackage the app to remove licensing checks, turn off security controls, or inject malware. This can lead to unauthorised access, data theft, or app functionality manipulation.

To mitigate the risk of code tampering, it is important to take the following steps:

Focus on Android root detection: Implement measures to detect whether the device running the application is rooted, as rooted devices can pose a higher risk of code tampering.
Check for test keys: Verify the build.prop file includes the line “ro.build.tags=test-keys,” which indicates a developer build or unofficial ROM. This can be an indicator of a potentially rooted device.
Check for OTA certificates: Look for the file “/etc/security/otacerts.zip.” This file is typically present on non-rooted devices, and its absence can suggest a rooted device.
Identify known rooted APKs: Search for the presence of specific APKs that are commonly associated with rooted devices. This can include checking for known SU binaries such as “/system/bin/su,” “/system/xbin/su,” “/sbin/su,” “/system/su,” and “/system/bin/.ext/.su.”
Attempt SU command directly: Execute the SU command and check the current user’s ID. If the returned value is 0, it indicates a successful execution of the SU command, indicating a rooted device.

Reverse Engineering

Reverse engineering involves analysing the app’s code to understand its inner workings, extract sensitive information, or identify vulnerabilities. Attackers may attempt to reverse engineer an app to uncover and exploit security weaknesses. Implementing code obfuscation and anti-tampering techniques can make it more challenging for attackers to reverse engineer the app.

To Prevent Reverse Engineering Attacks

verify whether your application can be de-complied or not. A reverse engineer works upstream of the usual development practices to discover an application’s logic and inner functionalities. For this, run your application in debugging tools used by attackers.

Other than this, you may do the following to refrain your application from reverse engineering. Implement good strong obfuscation and deploy metadata code obfuscation. Use C or C++ for application development as they offer libraries to protect runtime changes.

Separates the source code block and controls the code flow. Enforce binary packaging to refrain the attacker from directly code de-compilation. Implement a mechanism to avoid code debugging from tools such as IDA Pro and Hopper.

To prevent the risk of reverse engineering, it is essential to ensure that your application cannot be easily decompiled. Reverse engineers attempt to analyse and understand the inner workings of an application by going against the typical development practices. To safeguard against this, you can take the following measures:

Implement robust obfuscation techniques to make the code difficult to understand or reverse engineer.
Employ metadata code obfuscation to conceal critical information about the application’s structure and functionality.
Consider using programming languages like C or C++ that offer libraries and features designed to protect against runtime changes.
Separate code blocks and control the code flow to make it more challenging for reverse engineers to comprehend the application’s logic.
Enforce binary packaging to prevent attackers from directly decompiling the code and gaining insights into its inner workings.
Implement mechanisms to prevent code debugging using tools like IDA Pro and Hopper, commonly used by reverse engineers.

Extraneous Functionality

This vulnerability refers to including unnecessary or unused features in the app. These features may introduce additional attack vectors or increase the app’s attack surface. Removing or disabling any functionalities that are not required to minimise the potential security risks they may introduce is essential.

To prevent the risk of extraneous functionality, it is necessary to go beyond automated tools and conduct a thorough manual source code review. This process involves carefully examining the application’s configuration settings to identify hidden switches or potential vulnerabilities. Additionally, reviewing the API endpoints and log statements is important to ensure they are not publicly accessible or exposed by OEMs.

Assessing whether the accessible API endpoints are properly documented is also crucial. Lastly, scrutinising the content of the logs for any information related to backend server processes or privileged accounts is essential. By diligently performing these checks and taking appropriate actions based on the findings, you can mitigate the risk of extraneous functionality and enhance the overall security of your application.

Addressing these vulnerabilities requires a combination of secure coding practices, thorough testing, and regular security assessments. By following best practices, staying updated with the latest security guidelines, and prioritising security throughout the development lifecycle, developers can minimise the risk of vulnerabilities and enhance the overall security of mobile apps.