The OWASP Top 10 for Mobile Apps is highly focused on security checks for your mobile apps. The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications.

1. Mobile App Security Meet
OWASP Mobile Top 10

2. Mobile App Security Meet
Recap
History
● Open Web Application Security Project
● Started in 2001 as an online community
● De facto standard for Application security
● Mandated standard by Compliances
● 42000+ Strong

3. Mobile App Security Meet
Famous Projects
● Top 10 Issues (Documentation)
● Security tools
● Damn Vulnerable Apps (WebGoat)
● Code Review Guidelines

4. Mobile App Security Meet
Why Top10 for Mobile?
● Started in 2010
● Essential : Mobile >>> PC/Laptop
● Attack Landscape
● More Targets
● 6.1B by 2018

5. Mobile App Security Meet
What Mobile App Security boils down to?

6. Mobile App Security Meet
Securing assets on the device

7. Mobile App Security Meet
Principles
➢ Do not store/leak data ➢ Do not Drive

8. Mobile App Security Meet
Principles
➢ Do not store/leak data
➢ Do not store/leak sensitive data
➢ Do not Drive
➢ Do not Drink and Drive

9. Mobile App Security Meet
Principles
➢ Do not store/leak data
➢ Do not store/leak sensitive data
➢ Do not store/leak sensitive data in plain
➢ Do not Drive
➢ Do not Drink and Drive
➢ Do not Drink and Drive in a F1 race

10. Mobile App Security Meet
Relevant OWASP Sections
● M2 – Insecure Data Storage
● M4 – Unintended Data Leakage
● M7 – Client Side Injection
● M10 – Lack of Binary Protection

11. Mobile App Security Meet
M2 – Insecure Data Storage
● Adversary got physical access to phone
● Presence of Malware which accesses file system
● Your app runs on a rooted or jailbroken device

12. Mobile App Security Meet
M2 : Whats stored?
● Unames
● Authtokens
● Passwords
● UDID/EMEI **
● SSN
● Credit card Numbers
● Appdata – Cache, Log,

13. Mobile App Security Meet
M2 : Locations
● SQLite Dbs
● Log Files
● PlistFiles
● XML Files
● SD Card
● CloudSynced
● Shared Preferences

14. Mobile App Security Meet
M4 : Unintended Data Leakage
● Placing sensitive information in insecure location
● Overlap with M2

15. Mobile App Security Meet
M4 : Threat Model Locations
● Application Backgrounding
● Logging
● Clipboard
● URL Caching
● CrashLogs
● LocalStorage
● Analytics Data sent

16. Mobile App Security Meet
M7 Client Side Injections
● Execution of malicious code in the context and scope of mobile app
● Sometimes with privileged scope

17. Mobile App Security Meet
M7 : Locations
● Sqlite Injection
● Local file Inclusions
● XSS (WebView)
● Intent Injections

18. Mobile App Security Meet
M10 : lack of Binary Protection
● A Binary at a client side cannot be trusted for its integrity
● Execution of a Binary can be monitored and altered
● IP can be decoded and used elsewhere

19. Mobile App Security Meet
M10 : Results in
● Repackaging to insert Malware or Adware
● Bypass security Control
● Runtime Code Injection
● Method Swizzling

20. Mobile App Security Meet
M10 : Best Practices
● JailBreak Detection Controls
● Checksum Controls
● Debug Detection controls
● Android Root Detection

21. Mobile App Security Meet
Securing assets on the wire and at server

22. Mobile App Security Meet
● M1 – Weak Server Side Controls
● M3 – Insufficient Transport Layer Protection
● M5 – Poor Authentication and Authorisation
● M6 – Broken Cryptography
● M8 - Security Decisions via Untrusted Inputs
● M9 – Improper Session Handling

23. Mobile App Security Meet
M1 : Weak Server Side Controls
● Traditions SQL Injection
● XSS
● CSRF
● Other OWASP Top 10 (Web)

24. Mobile App Security Meet
M3 : Insufficient Transport Layer Protection
● Results in MITM
● SSL Certificates
● Strong enough Ciphers
● HTTP/HTTPS
● SSL Pinning

25. Mobile App Security Meet
M5 : Poor Authentication and Authorisation
All client-side authorization and authentication controls will be
bypassed
”

26. Mobile App Security Meet
M5 : Poor Authentication and Authorisation
Authorization and authentication controls must be re-enforced
on the server-side

27. Mobile App Security Meet
M9 : Improper Session Handling
● Results are same as M5
● Have a good time out
● Rotate cookies
● Switching access levels
● Creation of secure tokens

28. Mobile App Security Meet
M6 : Broken Cryptography
● Still using MD5, RC2 ?
● Move on!
● Use strong Algos
● White Box Crypto (WBC)!!

29. Mobile App Security Meet
M8 : Security Decisions Via Untrusted Inputs
● Threat model all your app inputs
● IPC??
● Hidden fields
● Parameters to determine access level

30. Mobile App Security Meet
Conclusion
● Mobile App Security is critical and maturing at a faster pace
● Refer to OWASP guidelines to build accepted level of security within the mobile applications