A Developer’s Guide to Mobile App Security

Mobile devices have become universally accepted and used today because they are easy to carry and can perform nearly the same functions as laptops and desktops.

Mobile devices have apps that allow users to play games, manage financial services, and access the internet. Unfortunately, these apps collect potentially sensitive information like phone numbers, email addresses, and credit card information that can be hacked. That’s why companies need to be certain that their apps are completely secure before they are made available to the public.

This article will help you understand the importance of mobile app security, the threats to mobile apps, measures for preventing problems, and the tools and standards for app security testing.

What is mobile app security?

Mobile app security involves checking applications for security issues based on the frameworks they are developed with, the platforms they run on, and the potential set of users. For example, a banking app will have to focus on safety of financial information while a social media app would need to protect users’ personal information such as their phone number and address.

All popular mobile platforms are designed with security controls to help developers build safe and secure applications. However, it is the developer’s responsibility to choose from the various security options available. Poor vetting may result in security features that can be easily circumvented by attackers.

In today’s world, mobile app security could be regarded as just as serious a matter as physical security. After all, a breach in mobile security can disclose a user’s current location, banking information, personal information, and more — in real-time.

Mobile app security solutions use unique identifiers to provide complete protection, which they achieve by actively detecting, preventing, and reporting attacks. They are designed to shield data and transactions from the strongest incursions and guarantee that user data will be absolutely safe.

Why is mobile app security important?

An analysis of mobile financial applications by Aite Group, commissioned by Arxan, revealed a significant lack of security across industries. For example, 97% of the financial services mobile apps analyzed during the study could be easily compromised in an average of 8.5 minutes. These compromises can endanger login credentials, personal information, APIs, private encryption keys and more, leading to billion-dollar losses, governmental penalties, and — most importantly — a lack of trust.

As indicated by the 2021 Cyber Security Breaches Survey, 4 in 10 businesses (39%) and a quarter of charities (26%) reported security breaches or attacks in the previous year. The world of mobile apps has seen some devastating hacks and data breaches that have caused companies to lose valuable customers. Here are some of the most shocking examples from the last two years:

• In January 2020 an internal error in the Walgreens mobile app admitted certain malware into the app, compromising the personal information of thousands of users.
• In August 2020 the Bengaluru-headquartered payments processor, Juspay, had a compromised server that leaked the data of 100 million users on the dark web. Juspay revealed that the cyber attack breached 35 million records of users with non-sensitive masked card data and card fingerprints.
• In April 2021 a North American mobile parking app called ParkMobile was exposed to a cyberattack involving the illegal sale of 21 million consumers’ account information. The stolen data included customers’ dates of birth, phone numbers, email addresses, mailing addresses, license plate numbers, and hashed passwords.
• In March 2021 a leading Indian payments app called Mobikwik suffered a data breach. Researchers alleged that the sensitive information of approximately 3.5 million users was put up for sale on the dark web. This personal data included the users’ KYC details, Aadhar card data, addresses, phone numbers, and other information.

When an app is hacked and users’ information is leaked, the company loses reputation, trust, users, and money. Whether it comes in the form of negative reviews or legal suits, user dissatisfaction directly affects the company’s standing. Users who have lost trust in the app are unlikely to continue using it or paying for the company’s services. Additionally, they would even warn their family and friends about the app’s risks, leading to a further decline in usership and sales.

As soon as the breach is detected, the company will have to quickly fix the issue, convince existing users not to leave the platform, and try acquiring new users to keep the business stable.

Fixing a security breach requires the company to spend a lot of time, money, and energy. The user needs to know that the issue is firmly fixed so they can feel completely safe and have faith in the business again.

In short, mobile app security is important — to keep users happy and your business steady.

What are the most common mobile app security issues?

Below are some mobile app security threats that developers should be aware of while creating an app. Of course, these aren’t the only threats, but they are certainly the most common ones.

Lack of multifactor authentication

Most users tend to set the same insecure password for multiple accounts. Even when a user’s password is compromised through a breach on some other company’s app, it can still pose a threat to your app because hackers usually test passwords on other apps as well.

Multi-factor authentication, often with two out of three possible authentication factors, ensures that your app does not rely solely on the password to certify the user’s identity. This extra layer of authentication can be an SMS confirmation code, biometric authentication (such as fingerprint or retina), or the answer to a personal question.

Failure to encrypt properly

Encryption involves converting data into an indecipherable code that can only be viewed after it is translated back with the secret key. In other words, it changes the order of a combination lock to prevent unauthorized access. According to Symantec, 10.5% of enterprise devices and 13.4% of consumer devices have not enabled encryption; this suggests that personal data will be available in plain text if hackers manage to access the devices. Lack of encryption can have severe consequences, from privacy violations to code theft, intellectual property theft, and ultimately reputational damage.

Even while using encryption, developers must be extremely careful as hackers can easily exploit a simple mistake. This is why developers and their teams must follow encryption standards to prevent any potentially damaging slip-ups.

Reverse engineering

Reverse engineering is a major threat to which every app is vulnerable. Through reverse engineering, an attacker can use the metadata provided in code (meant for debugging) to understand how the app functions on the back-end. They may also be able to gain access to the encryption algorithms and modify the source code. With reverse engineering, an attacker can use your code against you.

Exposure to malicious code injection

User-generated content, like forms and comments, is another element that poses a potential threat to mobile app security. For example, when users enter their username and password on a login form, the app communicates with server-side data to authenticate the login. If there is no limitation regarding the characters that can be successfully entered, hackers can inject code to access the app’s server. If an attacker enters a line of JavaScript into a login form that doesn’t guard against the colon or equal sign (commonly used in JavaScript), they can easily tap into private information.

Insecure data storage

Often, insecure data storage is caused by a lack of processes to handle images, key presses, or data cache. It can occur in SQL databases, binary data stores, cookie stores, and many other areas of an app. These data storage issues can be caused by vulnerabilities in the OS, compiler, frameworks, or in new and jailbroken devices. Once hackers gain access to a database or device, they can alter the legitimate app to redirect information to their machines. If a device is jailbroken or rooted, even the most sophisticated encryption protections are quite useless. Such devices allow hackers to bypass OS restrictions and dodge encryption.

What are the best practices for mobile app security?

The best practices of mobile app security help eliminate the risk from apps and avoid the disclosure of the user’s personal information. The developer needs to ensure that all security checks are completed before the app is uploaded to an app store for public use.

Hackers usually target public-facing applications, which are the main communication bridge between organizations and customers. Most public-facing applications are designed to be compatible with any device in the market. This approach, though, makes the app vulnerable to manipulation and attacks. Developers need to maintain the most rigorous filter mechanisms to thwart any possible attacks while building a watertight application.

Here are some of the best practices that developers can follow for mobile app security:

Use code obfuscation

Code obfuscation is a technique that uses automated tools to transform the source code into something that is tricky for humans to read. This does not make the code safer, but the aim is to make the process of reverse-engineering more complicated, so that it’s harder to reach the source code of a compiled application. If the hacker doesn’t know how the source code works, it becomes more of a problem for them to break into the application.

Be cautious with analytics

Developers who choose to implement their own analytics solution must be cautious about the information they want to collect. Hackers may be able to use analytics data to identify users or access their information. For instance, an analytics framework that records the screen for crash reports can also view and record the users’ login credentials.

Avoid logging sensitive information

Developers typically log to the console for debugging during the process of software development. However, most developers ignore the fact that iOS logs (for example) are public by default, and everyone who connects a phone to a PC can easily view the console logs. Therefore, developers must avoid logging sensitive information. Instead, system features like os_log should be used with placeholders to protect private information in debug messages.

Set a solid API security strategy

Developers must be careful about the application programming interfaces (APIs) used to create the app. If the API isn’t authorized, it could unintentionally give hackers easy access to the app. For example, if programmers cache authorization information locally for easy access during API calls and coding, cybercriminals can hijack the privileges and misuse them. To prevent these situations, it is important to establish a solid API security strategy that only allows centralized authorization of APIs.

Don’t trust third-party frameworks

Third-party frameworks or software development kits (SDKs) may be a big security risk for applications. Since they are compiled with the app and run in the same sandbox, they have the same rights as your app. This implies that a malicious SDK can obtain a user’s location if the developer asked for this permission. It can also read directly from the application data storage or keychain. Therefore, it is wiser not to trust any unknown library available on the internet.

Implement multi-factor authentication

Multi-factor authentication helps create an extra layer of security when a user logs into an app. It eliminates the security risk for users who have the same password on multiple sites or those who created weak passwords that hackers can guess easily. Multi-factor authentication produces a secret code that the user must enter with the password to log into an app or device. This code is sent by email, or via SMS, Google Authenticator, or biometrics.

Enforce session logouts

Users often forget to log out of the app or website they are using. Failing to log out can be risky in the case of a banking app or any other payment app. This is why payment apps either log out or end the user’s session after a certain period of inactivity. To ensure maximum security, developers do need to enforce a session logout on all consumer-centric and business apps, even if users are expected to be very security-literate.

How is mobile app security testing conducted?

In order to assess the safety of an app, it is important to run security testing. However, it is important to pick the right mobile application security testing methodology, if you are to get accurate results. Here are the most impactful strategies and methods for mobile app security testing:

Penetration testing (a.k.a. Pentesting)

Penetration testing is a classic approach that involves all-round security testing of the final or near-final build of the application (available at the end of the development process). Developers can use the Mobile App Security Verification Standard (MASVS) and its checklist as the baseline for testing. A typical security test is structured as follow:

• Preparation. This stage involves defining the scope of security testing, including finding the applicable security controls, setting the organization’s testing goals, and protecting sensitive data. Preparation includes synchronization with the client and legally protecting the tester (who is often a third-party). It is important to remember that in many parts of the world it is illegal to attack a system without written authorization.
• Intelligence gathering. This stage involves analyzing the architectural and environmental context of the app to gain a general contextual understanding.
• Mapping. This stage is based on information from the previous phases. It may be complemented by manually exploring the app and conducting automated scanning. Mapping offers a thorough understanding of the app, its entry points, the main potential vulnerabilities, and the data it holds. These vulnerabilities can then be sorted on the basis of the damage they may cause, so the security tester can prioritize and tackle them accordingly.
• Exploitation. In this phase, the security tester attempts to enter the app by exploiting the vulnerabilities found during the previous phases. This phase is essential for determining whether vulnerabilities found are true and real positives.
• Reporting. In this phase, the security tester reports the vulnerabilities that are essential to the client. This includes detailed exploitation, classifying the type of vulnerability, documenting the risk of an attacker compromising the target, and outlining the data that the tester has managed to access illegitimately.

Static analysis

Static analysis involves reviewing the mobile app’s source code to ensure proper implementation of security controls. In most cases, developers use a hybrid automatic/manual approach. Automatic scans can catch the low-hanging fruit, but the human tester can go one step further by exploring the code base, keeping in mind specific usage contexts.

Automated source code analysis. A tester can use automated analysis tools to speed up the review process of the Static Application Security Testing (SAST). These tools use a predefined set of rules or industry best practices to check the source code for compliance. The process typically displays a list of findings and warnings for any detected violation. While some static analysis tools run against the compiled app only, others need to be fed the original source code, while the rest work as live-analysis plugins in the Integrated Development Environment (IDE).

Manual code review. A tester can perform a manual code review by analyzing the mobile app’s source code for security vulnerabilities. They can use methods ranging from a basic keyword search through the ‘grep’ command, to a detailed, line-by-line examination of the source code. A common approach to manual code analysis involves identifying the main security vulnerability indicators by searching for APIs and keywords, such as database-related method calls like “executeQuery” or “executeStatement”. Code containing these strings is a good way to conduct a manual analysis.

In contrast to automatic code analysis, manual code review is ideal for finding vulnerabilities in business logic, standards violations, and design flaws, especially if the code is technically secure but has logical flaws. It is very unlikely that such scenarios will be detected by an automatic code analysis tool. A manual code review must be performed by an expert code reviewer who is proficient in both the frameworks and language used for the mobile app. A full code review can be slow, tedious and time-consuming for the reviewer, especially in the case of large codebases with many dependencies.

Dynamic analysis

The focus of Dynamic Application Security Testing (DAST) is the evaluation of apps using their real-time execution. The main goal of dynamic analysis is to detect weak spots or security vulnerabilities in a program while it’s running. Dynamic analysis is carried out at the mobile platform layer as well as against the backend services and APIs where the tester can analyze the app’s request and response patterns. Dynamic analysis helps check for security mechanisms that offer adequate protection against common attacks like authentication and authorization issues, as well as for disclosure of data in transit, and server configuration errors.

Whether a developer decides to use static or dynamic testing, they must also decide whether or not the tester knows the app before running the tests. A tester’s knowledge of the subject may influence the parameters of testing, the reading of results, and even the approach towards mitigating issues. There are three main types of testing based on the level of knowledge the tester possess:

Black-box testing

Black-box testing involves testing without giving the tester any information about the app. This process is also known as “zero-knowledge testing”. The main objective of this test is to allow the tester to act like a real attacker while exploring possible uses for any information that is publicly available and discoverable.

White-box testing

White-box testing, also known as “full knowledge testing,” is the opposite of black-box testing because the tester has complete knowledge about the app. This knowledge may include source code, diagrams, and documentation. White-box testing is quicker due to its transparency — the tester can use the extra information to build more sophisticated and granular test cases.

Grey-box testing

Grey-box testing is a method that falls between white-box and black-box testing. It involves providing the tester with some information (usually credentials only) while leaving them to discover other information independently. Grey-box testing is the most common type of testing in the security industry.

Reliable tools for mobile application security testing

Mobile penetration testing throws up many new challenges that aren’t usually seen in standard web application and infrastructure tests. Here are some great open-source tools to help overcome these potential difficulties:

ImmuniWeb MobileSuite

The ImmuniWeb MobileSuite features a unique combination of mobile app testing and backend testing. It covers the OWASP Top 10 for apps built for mobile devices, and SANS Top 25 and PCI DSS 6.5.1-10 for backend services. In addition, the ImmuniWeb MobileSuite provides a free online mobile scanner that helps SMEs and developers to detect privacy issues, verify app permissions, and run holistic DAST/SAST testing for OWASP Mobile Top 10. The ImmuniWeb MobileSuite ensures zero false-positive SLAs and a money-back guarantee for even one false-positive.

Zed attack proxy (ZAP)

Zed Attack Proxy (ZAP) is a popular security testing tool, and is completely open-source. In the past, it was used only to find vulnerabilities for web applications. However, it is now used by testers for security testing in mobile applications. ZAP testing works by sending a file or request via a malicious signal to assess the mobile app’s vulnerability to the message.

Quick Android Review Kit (QARK)

Quick Android Review Kit (QARK) helps the Android systems find security loopholes in source codes of the mobile app, and in the APK files. As a static code analysis tool, QARK provides information about Android app security risks with a clear and concise description of issues. What’s more, it populates the ADB (Android Debug Bridge) commands to assess vulnerabilities detected by QARK.

Android Debug Bridge (ADB)

Android Debug Bridge (ADB) is a command-line tool which reliably communicates with an emulator or connected Android device to test mobile app security. ADB includes the “client” (which sends commands), “daemon” (which runs commands), and “server” (which manages communication between the client and the daemon).

Micro Focus

Micro Focus is focused on delivering enterprise solutions for Security & Risk Management, Hybrid IT, DevOps, and more. Micro Focus allows end-to-end mobile app security testing across multiple devices, networks, servers, and platforms. It also provides a tool called Fortify, which secures a mobile app before allowing installation on a mobile device.

Overview of mobile app security standards

When looking for viable solutions that can highlight code defects and vulnerabilities in mobile apps, it is important for companies to understand the application security standards. Application security standards work to improve the safety and security of apps. The best approach for selecting an app security solution is to explore tools based on leading industry standards like OWASP, CVSS, CWE, NIAP and ioXt. Here’s how these major mobile app security standards work:

OWASP Top 10

When choosing a quality mobile app security tool, it is important to ensure that it meets the testing and security requirements set by the OWASP (Open Web Application Security Project) Mobile Top 10. The OWASP Mobile Top 10 is trusted by millions and acts as a baseline for mobile application security. It helps security and development teams detect and mitigate vulnerabilities in the SDLC to improve code quality and reduce security flaws before deploying and producing the app. OWASP Mobile Top 10 covers all important security categories such as authorization, authentication, reverse engineering, data security at rest and in motion, and quality of code. These are all important issues for any development team to include on its mobile app security checklist.

Common Vulnerability Scoring Systems (CVSS)

Common Vulnerability Scoring Systems or CVSS is a widely recognized standard for rating the severity of app vulnerabilities and deciding the urgency of mitigation. CVSS generates a numerical score that highlights risk severity by evaluating the key features and aspects of the vulnerability. This score can be translated into low, high, or medium groupings. The security teams can then prioritize their next steps and boost their remediation and vulnerability management measures.

Common Weakness Enumeration (CWE)

Common Weakness Enumeration or CWE is managed and sponsored by the US-CERT program of the Department of Homeland Security in the US. The security program for the mobile app is developed by the community, and consists of a list of the most commonly found vulnerabilities within app security. CWE is used by most trusted mobile app security testing tools to provide an elaborate understanding of the possible security flaws. Based on this insight, development teams can select the best security tools and services to recognize and remediate their app security issues.

National Information Assurance Partnerships (NIAP)

National Information Assurance Partnerships, or NIAP, is an IT security program created by the government to ensure that all its apps align with governmental security standards and focus on end-customer needs. In addition, the NIAP details comprehensive security assessment guidelines to ensure that the relevant apps fit the risk evaluation criteria. The security tools that follow strict security standards are generally considered one of the most appropriate options for security testing.

Internet of Secure Things Alliance (ioXt)

With the arrival of smart devices based on technologies like IoT, it is necessary to safeguard the devices and associated mobile apps from serious security threats. The Internet of Secure Things Alliance (ioXt) is a major security program focused on security and regulation compliance for connected devices and associated apps. More than 300 companies are members, including Facebook, Google, Amazon, Comcast and Schneider Electric. The ioXt creates security parameters for a range of devices such as smart speakers, webcams, and lighting devices, as well as the mobile apps that manage them.

GDPR, PIPEDA, and HIPAA Compliance

Apart from the mobile app security standards outlined above, it’s advisable to comply with GDPR, PIPEDA, and HIPAA regulations.

The General Data Protection Regulation (GDPR) involves providing users with the choice of whether to give direct consent to collect and use their data. A developer can meet this obligation by providing a checkbox or a button to accompany any information form.

The Personal Information Protection and Electronic Documents Act (PIPEDA) requires an app to follow ten principles for safeguarding users’ personal data, by which it means “any factual or subjective information about an identifiable individual.” A developer can make an app PIPEDA-compliant by implementing the ten principles mentioned in the official PIPEDA document.

The Health Insurance Portability and Accountability Act (HIPAA) standardizes the management of protected health information (PHI)  — all “individually identifiable health information” transmitted or maintained in any format or medium.

Apps that violate GDPR, PIPEDA or HIPAA may face heavy fines or even criminal charges.

Conclusion

Releasing an app may well bring enormous benefits to customers. However, companies must take the necessary precautions to ensure proper security, as an app won’t be very useful if it leads to the theft of user data. This is why, while developing an application, mobile app security must be a top priority if developers are to mitigate potential risks. The app should then be monitored after its launch to identify and resolve any potential vulnerabilities or issues. Although this effort may need a lot of time and energy, it’s always better to be safe than sorry!

If you’re considering building a secure app for your business, you’re going to need an experienced and reliable partner. Since 2007, PixelPlex has worked  with over 100 qualified specialists to deliver top-quality products in 120 countries. PixelPlex handles everything from discovery and planning to launch and support, allowing you to focus on the exponential growth of your business.