Mobile Device Attack Vectors

Mobile apps usually involves a three tier architecture. The mobile app, the API backend, and its associated database. We will be mainly concerned with attacks on the client side.

Mobile device threats

  • Application data at rest
  • Application data in transit
  • Vulnerabilities in code
  • Data leaks in the app
  • Platform specific issues

Threats at the backend

  • Authentication/Authorization
  • Session management
  • Input validation
  • Improper error handling
  • Weak cryptography
  • Attacks on the database

OWASP provides guidelines for testing and securing mobile apps. They have come up with the OWASP Mobile Top 10 guidelines.

Another organisation, Veracode also offers mobile security and testing guidelines.

OWASP Mobile Top 10 Risks

OWASP have come up with the following guidelines, we will cover them in depth in OWASP Mobile Top 10 Risks

  • M1: Weak Server-Side Controls
  • M2: Insecure Data Storage
  • M3: Insufficient Transport Layer Protection
  • M4: Unintended Data Leakage
  • M5: Poor Authorization and Authentication
  • M6: Broken Cryptography
  • M7: Client-Side Injection
  • M8: Security Decisions via Untrusted Inputs
  • M9: Improper Session Handling
  • M10: Lack of Binary Protections