Poor authorization and authentication on mobile applications can allow unauthorized access. It occurs when things like long session timeouts, weak passwords, or hidden logout buttons are present. This exposes applications to technical impacts like being unable to identify users and business impacts like reputational damage from fraud or theft. Developers can detect these issues by testing account lockout policies, password strength, and attempting to bypass authentication. Prevention includes assuming client-side controls may be bypassed, enforcing authentication on the server-side, using persistent and device-specific authentication, and not allowing short or spoofable authentication values.

1. Poor Authorization and
Authentication
Bouzidi Nayrouz
Gouia Salma
Zarrouk Asma

2. Plan
1
2
3
4
Introduction
What is Poor Authorization and Authentication?
How can you detect Poor Authorization and
Authentication ?
How can you prevent Poor Authorization and
Authentication attacks ?
5 Conclusion
2

3. Introduction
3

4. Mobile security is at the top of every company's worry
list these days ,and for good reason : Nearly all workers
now routinely access corporate data from smartphones,
and that means keeping sensitive info out of the wrong
hands is an increasingly intricate puzzle . Furthermore,
As smartphones and tablets become constant
companions, hackers are looking for all avenues
available to enter them that’s why today we are going to
talk about one of the risks that can attack mobile
application , poor authentication and authorization
4

5. What is Poor
Authorization
and
Authentication?
5

6. What is it ?
- Hidden Logout button
- No password complexity specially on mobile
- Long session time out
- No account lock out
- Authorization flags or based on the local storage
6

7. Impacts of Poor Authorization and
Authentication?
Technical Impact
unable to identify
the user
performing an
action request
Business Impact
reputational
Damage, fraud, or
information theft
7

8. How can you
detect Poor
Authorization
and
Authentication ?
8

9. Test account
lockout policy
Test strong
password policy
Try to bypass
authentication
9

10. How can you
prevent Poor
Authorization
and
Authentication
attacks
?
10

11. Assume that client-
side authorization and
authentication
controls can be
bypassed
Authentifications
must be
re-enforced on the
server-side whenever
possible.
Persistent
authentication
Device-specific
authentication.
Do not use any
spoof-able values for
authenticating a
user.
Do not allow
users to
provide 4-digit
PIN numbers
Mitigations
11

12. Conclusion
12

13. 13
Authentication and Authorization are very important for
securing resources and limiting access. The lack of
security in this field have emerged as major issues
which threaten to hinder progress.

14. Thank you