View
97
Download
3
Category
Tags:
Preview:
DESCRIPTION
OWASP Mobile Top 10. Beau Woods http://beauwoods.com @ beauwoods. To get involved get in touch with the project leader https:// www.owasp.org/index.php/OWASP_Mobile_Security_Project. - PowerPoint PPT Presentation
Citation preview
OWASP Mobile Top 10
OWASP Mobile Top 10 Risks presentation at OWASP Korea July 13, 2013 is licensed under a Creative Commons Attribution 3.0 Unported License.
Beau Woodshttp://
beauwoods.com@beauwoods
To get involved get in touch with the project leaderhttps://www.owasp.org/index.php/OWASP_Mobile_Security_Project
2
Bluetooth
NFC/RFID
Backup
Mobile Elements
ClientPlatformHardwareNetworkServer
ApplicationApplication
2Other considerations
3
Mobile Comparison Use models
Always on Always connected
Omnipresent
Capabilities Communications Limited resources Highly variable
Hardware Extensive RF & SSD
Highly variable Not upgradable
Platform Highly variable Limited options Variable security
MobileDevices
Use models Frequently off Disconnected Location-bound
Capabilities Many resources Robust platform Well documented
Hardware Limited RF & HDD Highly variable Highly upgradable
Platform Standardized Well understood Robust security
TraditionalDevices
3
4
OWASP Mobile Top 10 Risks M1 Insecure Data Storage M2 Weak Server Side Controls M3 Insufficient Transport Layer Protection M4 Client Side Injection M5 Poor Authorization and Authentication M6 Improper Session Handling M7 Security Decisions via Untrusted Inputs M8 Side Channel Data Leakage M9 Broken Cryptography M10 Sensitive Information Disclosure 4
Alpha Documentation
Mobile Security Project
Top 10 Risks Top 10 Controls Threat Model Testing Guide Tools Secure Development
5
M1 Insecure Data StorageSensitive dataAuthentication dataRegulated informationBusiness-specific informationPrivate information
Examples
RecommendationsBusiness must define, classify, assign owner & set requirementsAcquire, transmit, use and store as little sensitive data as possibleInform and confirm data definition, collection, use & handling
Protections1. Reduce use and storage2. Encrypt or hash3. Platform-specific secure storage with restricted permissions
Mobile Contro
ls1, 2 &
7
5
6
M2 Weak Server Side Controls OWASP Top 10 Web Application Risks 2013
A1 Injection A2 Broken Authentication and Session Management
A3 Cross-Site Scripting (XSS) A4 Insecure Direct Object References A5 Security Misconfiguration A6 Sensitive Data Exposure A7 Missing Function Level Access Control A8 Cross-Site Request Forgery (CSRF) A9 Using Components with Known Vulnerabilities
A10 Unvalidated Redirects and Forwards
Mobile App ServersRESTful API
SOAPWeb Service
Web XML
RecommendationsAlways validate inputDon’t trust the clientHarden mobile app servers & servicesBeware information disclosureUnderstand host & network controlsPerform integrity checking regularly
Mobile Contro
ls5 & 6
7
M3 Insufficient Transport Layer ProtectionExamplesImpact
Expose authentication dataDisclosure other sensitive informationInjectionData tampering
RecommendationsUse platform-provided cryptographic librariesForce strong methods & valid certificatesTest for certificate errors & warningsUse pre-defined certificates, as appropriateEncrypt sensitive information before sendingAll transport, including RFID, NFC, Bluetooth Wifi, CarrierAvoid HTTP GET method
Mobile Contro
ls3
8
M4 Client Side InjectionImpactApp or device compromiseAbuse resources or services (SMS, phone, payments, online banking)Extract or inject dataMan-in-the-Browser (MITB)
RecommendationsAlways validate inputDon’t trust the serverHarden mobile app clientsBeware information disclosurePerform integrity checking regularly
Mobile Contro
ls9
9
M5 Poor Authorization and Authentication
ExamplesImpactsAccount takeoverConfidentiality breachFraudulent transactions
RecommendationsUse appropriate methods for the riskUnique identifiers as additional (not only) factorsDifferentiate client-side passcode vs. server authenticationEnsure out-of-band methods are truly OOB (this is hard)Hardware-independent identifiers (ie. Not IMSI, serial, etc.)Multi-factor authentication, depending on riskDefine & enforce password length, strength & uniqueness
Most common methodsAccount name PasswordOauthHTTP CookiesStored passwordsUnique tokens
Mobile Contro
ls4
10
M6 Improper Session Handling
RecommendationsAllow revocation of device/passwordUse strong tokens and generation methodsConsider appropriate session length (longer than web)Reauthenticate periodically or after focus changeStore and transmit session tokens securely
Mobile Contro
ls4
ImpactsAccount takeoverConfidentiality breachFraudulent transactions
Most common methodsOauthHTTP CookiesStored passwordsUnique tokens
11
M7 Security Decisions via Untrusted InputsDescriptionReliance on files, settings, network resources or other inputs which may be modified.
RecommendationsValidate all inputsDigitally sign decisioning inputs, where possibleEnsure trusted data sources for security decisions
ExamplesDNS settingsCookiesConfiguration filesNetwork injectionMobile malwareURL calls
12
M8 Side Channel Data LeakageSide channel dataCachesKeystroke logging (by platform)Screenshots (by platform)LogsRecommendationsConsider server-side leakageReduce client-side loggingConsider mobile-specific private informationConsider platform-specific data capture featuresSecurely cache data (consider SSD limitations)
Examples
Mobile Controls1, 2, 3, 6
& 7
13
M9 Broken CryptographyExamplesCryptography
…is not encoding…is not obfuscation…is not serialization…is best left to the expertsRecommendationsUse only well-vetted cryptographic librariesUnderstand one-way vs. two-way encryptionUse only well-vetted cryptographic libraries (not a typo)Use only platform-provided cryptographic storageUse only well-vetted cryptographic libraries (still not a typo)Protect cryptographic keys fanaticallyUse only well-vetted cryptographic libraries (seriously - always do this)
“The only way to tell good cryptography from bad cryptography is to have it examined by experts.”
-Bruce SchneierMobile Contro
ls1, 2 &
3
14
M10 Sensitive Information DisclosureSensitive application dataAPI or encryption keysPasswordsSensitive business logicInternal company informationDebugging or maintenance informationRecommendationsStore sensitive application data server-sideAvoid hardcoding information in the applicationUse platform-specific secure storage areas
M1 deals with customer dataM10 deals with application or developer data
15
Case StudyM1 Insecure Data Storage
• Account number & passcode stored in flat text file
Risks & mitigating factors• Passcode not used for other
systems• App contained and accessed
sensitive and private information
16
Case StudyM5 Poor Authorization &
Authentication• Account name and password in plain text• Used HTTP GET method (logged to server)
M8 Side Channel Data Leakage• Logged password to client and server
M9 Broken Cryptography• First attempt to fix issue obfuscated password
Risks & mitigating factors• Same password used for web application• Password reuse likely• Stored password securely
17
Case StudyM1 Insecure Data Storage
• Account name & password stored in flat text file
Risks & mitigating factors• App accessed private information• Password reuse likely• App used in Arab Spring and other
protests
18
DIY Vulnerability Discovery• Explore files on mobile devices and
backups• Search for passwords• Sniff network connections• Downgrade SSL
OWASP Resources• WebScarab• GoatDroid• iGoat• MobiSec• iMas• Mobile Testing Guide
19
Beau Woodshttp://
beauwoods.com@beauwoods
We have a long road ahead – your comments and participation are appreciatedTo get involved get in touch with the project leader
https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
Recommended