Vulnerabilities, threats and attacks on mobile applications

Vulnerabilities, threats and attacks on mobile applications

1. 1) Bad data storage practices

   • Databases such as SQLite make it easy to store compact data on a local device
     • All it takes to access the data stored on an unlocked smartphone running a poorly written app is a simple extraction of the file attached to the mobile application, then a query.

2. Mobile application vulnerabilities exist is because inexperienced programmers have bad data storage habits

3. 2) Malware

   • Google has deployed Google Bouncer in response to malware, but Google Play still isn't fully protected from malware-laden apps.
     • There are also inconsistent updates and patches to the Android operating system.
       • You can't count on Android to update itself in a timely manner. That makes it more difficult for Android devices to stay up-to-date with protection against vulnerabilities.

4. 3) Unauthorized access

   • User approval is required before any app can access other data or apps on an Android device. Mobile application vulnerabilities are not limited to Android apps.
     • A mobile application called Path, for example, offered a new way to socialize with friends and was hailed for its great user interface.
       • What Path did was an example of overzealous developers trying to provide a better user experience

5. 4) Lack of encryption

   • Applications that don't use encryption can cause problems as well. LinkedIn's mobile application, for example, transferred local calendar data to LinkedIn servers when the site rolled out a new calendar integration feature.
     • It is almost impossible to find out those details without transparency from the app developer or a full analysis of the app.

6. 5) Data leaks from syncing

   • Dropbox suffered a password breach that exposed many user accounts to a hacker. Luckily, it only resulted in those users receiving some spam.
     • A user could expose data to a security issue on Dropbox without being fully aware. In the event of a security breach or a password issue, these services rely on verification through email.
       • Ensure users don't have the same password for every app or service. Make sure they follow the one site, one password rule to limit mobile application vulnerabilities. Discourage users from storing sensitive work data in these cloud services that IT does not control.