[Day 12] 5. OWASP Mobile

OWASP Mobile Top 10 Risks

1. M1: Improper Credential Usage

   • Description: Weaknesses in how credentials are managed or used, leading to poor authentication and authorization practices. This includes weak password policies, poor token management, and improper use of session management.
   • Examples: Hardcoded passwords, credentials stored insecurely, or the reuse of passwords across multiple platforms.

2. M2: Inadequate Supply Chain Security

   • Description: Risks arising from third-party libraries, SDKs, or frameworks used in mobile applications. Malicious code or vulnerabilities in these components can be exploited.
   • Examples: Including insecure or outdated libraries, dependency on untrusted third-party code, and lack of monitoring over third-party components.

3. M3: Insecure Authentication/Authorization

   • Description: Weak or broken mechanisms for authenticating users and controlling access to sensitive data or functionality. This can lead to unauthorized access or privilege escalation.
   • Examples: Insecure storage of authentication tokens, improper session handling, and lack of strong authentication mechanisms.

4. M4: Insufficient Input/Output Validation

   • Description: Failure to properly validate user input or sanitize output, which can lead to vulnerabilities like code injection or buffer overflows.
   • Examples: SQL injection, XML injection, improper validation of user input fields, and failure to properly encode output.

5. M5: Insecure Communication

   • Description: Insecure transmission of sensitive data over unprotected networks. This includes the use of insecure protocols and failure to use encryption where required.
   • Examples: Data sent over HTTP instead of HTTPS, failure to validate SSL/TLS certificates, and improper handling of session tokens during communication.

6. M6: Inadequate Privacy Controls

   • Description: Weak controls over personal data that can lead to privacy violations. This includes improper collection, storage, or sharing of sensitive information.
   • Examples: Collecting unnecessary data, poor consent management, and inadequate protection of user privacy settings.

7. M7: Insufficient Binary Protections

   • Description: Weaknesses in protecting the app’s code and binary files, making it easier for attackers to reverse-engineer the app and extract sensitive information or exploit vulnerabilities.
   • Examples: Lack of code obfuscation, poor binary protection mechanisms, and the use of insecure libraries or third-party code that can be exploited.

8. M8: Security Misconfiguration

   • Description: Misconfigurations in the app’s settings or the underlying infrastructure that lead to security vulnerabilities.
   • Examples: Default settings that are insecure, open ports, unnecessary services running, and misconfigured APIs.

9. M9: Insecure Data Storage

   • Description: Storing sensitive information insecurely, which can be accessed by attackers if the device is compromised or if the data is improperly handled.
   • Examples: Storing unencrypted passwords, personal information, or session tokens in the app’s local storage or in the cloud.

10. M10: Insufficient Cryptography

    • Description: The failure to properly encrypt sensitive data or the use of weak cryptographic algorithms that can be easily broken.
    • Examples: Using outdated cryptographic standards (e.g., MD5 or SHA1), weak key management, or improper use of encryption libraries.

These are critical risks to consider while developing and securing mobile applications. Implementing secure coding practices and addressing these risks can significantly enhance the security posture of mobile apps.