This document outlines privacy and security issues that mobile app developers have overlooked. It notes that 90% of banking apps are exposed to traffic interception, 50% are vulnerable to injections, and 40% do not validate SSL certificates. It discusses how users are often unaware of the extensive permissions granted to apps to access location, contacts, photos and other data. The document calls for privacy impact assessments and standards to define secure development, app store security practices, and responses to security breaches, including cloud-based device management. It aims to provide guidance to protect consumer privacy and business interests.

1. Norshidah Mohamed, PhD
International Business School
http://www.ibs.utm.my
Universiti Teknologi Malaysia
Kuala Lumpur
17 June, 2014

2. 2
OUTLINE
• Data protection issues in mobile apps –
what have developers overlooked?
• Consumer’s/user’s privacy experience –
protect or expose?
• Privacy Impact Assessment
• Guidance for consumer/user and business

3. 3
WHAT HAVE DEVELOPERS
OVERLOOKED?
Indicators of some critical vulnerabilities in
banking apps:
• 90% of apps are exposed to traffic
interception (with several non-SSL links)
• 50% of apps are vulnerable to JavaScript
injections
• 40% of apps did not validate the authenticity
of SSL certificates
Source: http://www.darkreading.com/vulnerabilities---threats/weak-security-in-most-mobile-banking-apps/d/d-
id/1141054?

4. 4
USER’S PRIVACY – PROTECT
OR EXPOSE?
• Competitive ecosystem – Apple iTunes &
Android based platform
• Most developers are not trained to develop
secure apps
• Use of cloud-based apps is a trade-off
between handing over privacy and download
of apps
• Research has shown that user is unaware of
the implications of giving permission to
download an app

5. 5
USER’S PRIVACY – PROTECT
OR EXPOSE?.. cont’
• Location, contacts, calendar, reminder,
photos – are just some examples that
downloaded apps access!
• Apps could have been created by fraudsters
and loaded with malware
• Unsecured WiFi is a toll-free highway for
fraudsters to gain access to mobile devices,
seize control or gain access to account
information.

6. 6
PRIVACY IMPACT
ASSESSMENT?
What’s being done?
De Facto standards that define:
• development and test of secure mobile apps?
• apps store security practice?
• corrective actions on security breach?
• cloud-based management that include
provisioning, policy, data management of
mobile devices

7. 7
PRIVACY IMPACT
ASSESSMENT? ? .. cont’
• authentication to several cloud-based
providers
• ISO?
• IT governance framework?
• Mobile App Security Working Group

8. 8
SELECTED RECENT CASES &
GUIDANCE?

9. 9
SELECTED RECENT CASES &
GUIDANCE?

10. 10
SELECTED RECENT CASES &
GUIDANCE?

11. 11
THANK YOU
norshidah@ic.utm.my