Mobile banking has been on the rise. In July, IDC reported mobile banking use doubled in between its annual surveys on the topic.
But the growth in popularity may not be matched by a growth in security, something underscored by problems recently reported in mobile applications from a variety of high-profile companies, including Wells Fargo and PayPal. The problems – reported here by viaForensics – include a failure to securely store passwords and usernames, and according to some, paint a not so rosy state of mobile application security.
“The mobile device itself cannot be considered to be trusted, devices are lost and stolen all the time,” opined Richard Wang, manager of SophosLabs, the research arm of security firm Sophos. “I think these incidents show that the comparative lack of experience of mobile developers when it comes to security considerations. Threats against the PC existed long before online banking became commonplace so developers had to build in security from the start…storing usernames and passwords in plain text on the device is a rookie mistake.”
A huge difference between mobile applications and Web applications is that Web apps store their data and programming code mostly on the server side, whereas mobile applications have most of their code and a lot of the data on the device, said Dan Cornell, CTO of Denim Group.
“For mobile applications most of the application code and a lot of the data resides on the device and these devices are under the control of the attackers,” Cornell said. “When you deploy a mobile application for your organization you have to assume that an attacker will install the device on their phone, root or jailbreak the phone and then be able to inspect the application. I have a whole presentation online along with some code that demonstrates how to perform some of this. This allows attackers to actually retrieve the code that runs the application in many cases.”
Rutul Dave, technical marketing manager at Coverity and himself a former software developer, said that many app developers and phone software providers have used software designed to run on traditional computing systems and customized for mobile to get to market faster. It has been an effective strategy, he said, but has created security concerns.
“Security needs to be addressed in development, in software code,” he said. “On top of (a) shortage of developers who are experienced in app development for mobile, it’s hard to find developers who understand security on this new computing platform.”
“The common thread as far as security concerns go for Web apps and mobile apps is that they are connected to the network, and in-turn accessible to hackers,” he added. “However, mobile apps add a new dimension to the security threat because the applications (that) are running on mobile devices are a new breed of software designed to specifically run on platforms that are very different from your traditional computing platforms.”
The situation is further complicated because mobile applications don’t have the additional security buffers of firewalls and security software that are available on the fully-fledged computing systems, Dave noted. Then there is the number of platforms involved – each with its own security capabilities.
Fortunately, there are best practices mobile application developers can follow. One, Cornell said, is to keep sensitive data on the server side whenever possible and to write all server-side portions of the applications in such a way that they validate any information sent from the smartphone software.
Beyond that, general best practices, such as performing threat modeling early in the development process and testing software for security, are the rule of the day, Cornell added.
“All (developers) certainly aren’t going to be experts but everyone ought to have at least some base-level knowledge and most teams should probably have a “go to” security person with more advanced knowledge and training,” he said. “For teams building mobile applications they should be instructed on the security features of their chosen mobile development platform(s) as well as any specific concerns for security in the environment(s).”