There are 1.96 million apps in the AppStore and 2.87 million apps on the Google Play Store. Users registering in each app provide information about themselves, and it’s the responsibility of the app owner to make sure that all the information, whether provided by the users or tracked within the app, is not misused by third parties. Thus while creating the app, you should thoroughly work on your security measures, which will help to defend it from such attacks as malware, phishing, hacking, or other criminal actions. Different cyber threats demand the usage of various security technologies within a mobile app.
Recently I wrote an article about data protection in web, and now want to focus on mobile app data. Securing your app is as important as securing your databases and cloud storage systems. The first and the main threat is data leakage. When a user logs in to the app, it provides access to the data on his device. So if the hacker attack occurs, the criminal can get vulnerable information aside from the app use-case, such as banking accounts or password storage.
Applications are also vulnerable to malware, as some apps can be downloaded from unauthorized platforms containing malicious software. This issue is especially applicable to Android users rather than iOS. Once such an app has been installed, it can affect even the apps downloaded from GooglePlay.
The other problem comes from the usage of weak passwords by your customers. Any app requires a password for registration, and many users just put the same password. Furthermore, criminals can log in to any other account by gaining access to one password.
Another vulnerability of the app may come from using outdated operating systems and software. As hackers become more cunning in their attacks, outdated software can’t detect or prevent them.
Your users can also face social engineering attacks, also known as phishing. This happens when the user receives the message from a trusted source, such as a bank or ads with the requirement to provide private information.
Even though encryption is a core of mobile security, there still may be some gaps. If the data is coming from your users' devices to your system or your system sends the data to the cloud, all of it must be encrypted. If this measure is neglected, hackers can use those gaps to steal transferred data.
To avoid all those threats, you can use several practices to make your app secure. Consider them through the whole lifecycle of your app: before, during, and after the software development process.
Most common app vulnerabilities you should take into account.
While creating your app, it’s helpful to keep in mind the most common vulnerabilities listed by the Open Web Application Security Project (OWASP). The global community of security experts defines those vulnerabilities and how to avoid them, and how to code in a secure way that may prevent your app from the breach at the very beginning. They consider injection attacks, authentication and session management, security misconfiguration, and sensitive data exposure. The list of vulnerabilities slightly changes through the years, which shows terrible dynamics in the app security sector.
The 2021 list of vulnerabilities by
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery (SSRF)
How to make your app secure
Secure Code
Compress, obfuscate and optimize your code. For example, code compression detects and safely removes unused classes, fields, methods, and attributes from the application and its dependencies. Resource compression removes new resources from the packaged application and its dependencies. Obfuscation shortens class and method names, reducing the size of the application's DEX files while optimization checks and refactors the code.
Encrypt your data
Encryption is a crucial component of your data security strategy and a guarantee of your user's privacy. Even if your network was broken for the lack of outer solid perimeter security and your customers' information was revealed, there's no way that the hackers can read it or use it.
Save the encrypted or scrambled data in your database, thus making it unreadable, though valuable for those who know how to query it.
Secure user authentication
When a user creates an account on your site, he trusts you. Often in this process, the user may agree to terms of service on how they can interact with the site and services and how the site owners will use the data and information that users provide in the application. One of the essential steps in complying with your part of this agreement is to keep the user's login information secure and confidential.
You can use a separate application for authentication or a Trusted Execution Environment (TEE). The central processors require the latter to protect the operating system used to run the application and protect sensitive data.
Third-party code
Using third-party code is a common practice in application development. However, is it possible to ensure its safety? Open source scanners will help you figure it out. They show which free software versions are used in the project, what type of license they have, and whether vulnerabilities exist.
How to choose a code analyzer? It must support the languages and frameworks used in the project, integration tools such as Gitlab CI, Jenkins, or TeamCity, and development tools so that the programmer can work in a familiar environment.
Libraries
Keep your dependencies and libraries up to date to make them more secure. At the same time, make sure that the libraries are safe: malicious code can be embedded in freely distributed libraries used for software development. The use of such software may lead to malware infection.
APIs
Protecting Application Programming Interfaces (APIs) is a severe challenge. The API is a rapidly growing attack surface that is little known. According to the OWASP API Security Project, "By their nature, APIs expose application logic and sensitive information such as personal data, and for this reason, APIs are increasingly being targeted by attackers. Rapid innovation is not possible without secure APIs."
API security focuses on strategies and solutions for understanding and mitigating their unique security vulnerabilities and risks.
Principle of least privilege
The principle of least privilege is based on the idea that each user should only have access to the resources necessary to perform the required duties. When benefits are distributed strictly within the scope of responsibility, the risk of damage from many potential insider threats is significantly reduced. In a well-organized and secure network, it is the responsibility of the administrator to audit the access rights of all users. The principle of "all for all" would quickly lead to chaos.
Proper session handling
The user session mechanism allows an application to recognize requests from an already authenticated user without forcing the user to enter a username and password to submit each request. This is done by using some unique user ID, which is assigned after a successful login procedure and sent with each request. From a security point of view, the chosen user session management mechanism mustn't be vulnerable to attacks such as session hijacking and session fixation.
To do this, the value of the session ID must be random and hard to predict, and each time a user logs in, a new session ID must be assigned to the user. The previous identifier must be invalidated.
Application security testing
Testing an application for vulnerabilities is a must if you want it to be safe for users. Mostly white-box and black-box methods are used. The white box method involves verification by a developer who has access to the code. The black box method only analyzes the user experience without evaluating the code. You can test manually or with the help of special services.
To understand how to ensure the security of an application, you should study the most dangerous vulnerabilities, take them into account at the development and testing stage, and if they are identified, eliminate and be sure to document all the problems found to avoid them in the future.