Common Mobile Application Vulnerabilities

Insecure Data Storage

This occurs when sensitive information (passwords, credit card numbers, personal identification numbers, etc.) gets stored insecurely on the device.

‍

Code Example

‍^{//Insecure data storage}

^{String password = "password123";}

^{SharedPreferences prefs = getSharedPreferences("myPrefs", Context.MODE_PRIVATE);}

^{SharedPreferences.Editor editor = prefs.edit();}

^{editor.putString("password", password);}

^{editor.commit();}

‍

In the example above, a password is stored in plain text in shared preferences, potentially exposing it to attackers able to access the file. Instead, developers should use encryption to secure sensitive information.

Unintended Data Leakage

This occurs when sensitive information, such as user credentials or confidential business data, is inadvertently leaked through the application's code or configuration.

‍

Code Example

‍^{//Unintended data leakage}

^{String apiKey = "abcdefghijklm";}

‍

In the example above, the API key is hardcoded as plain text, which an attacker can access by reverse engineering the application. To prevent unintended data leakage, developers should avoid using static keys.

Weak Server-Side Controls

This vulnerability is the result of server-side controls that inadequate in protecting sensitive information and fail to prevent unauthorized access.

‍

Code Example

^{//Weak server-side controls}

^{if (username.equals("admin") && password.equals("password")) {}

 ^{//grant access}

^}

‍

In the example above, the application is using hard-coded credentials for authentication. Attackers, who are aware of the credentials, can use these to gain unauthorized access to sensitive information. To strengthen server-side controls, use secure authentication and authorization mechanisms (e.g. OAuth or JSON Web Tokens).

Improper Session Management

This occurs when the application fails to properly manage user sessions, which can lead to session hijacking attacks.

‍

Code Example

^{// Improper session management}

^{String sessionId = request.getParameter("sessionId");}

^{if (sessionId != null) {}

 ^{//grant access}

^}

‍

In the example above, the application is using the session ID that is passed in the request to authenticate the user. However, the application fails to validate that the session ID actually matches the user it is intended to identify. This can lead to session hijacking as an attacker can use a valid session ID to access another user's details. To properly manage sessions, developers should generating a unique and cryptographically-secure session ID for each user and check that the ID matches the user for each request.

Insufficient Transport Layer Protection

This vulnerability occurs when the application fails to properly protect sensitive information during transmission, such as by failing to use secure protocols like HTTPS.

‍

Code Example

^{// Insufficient Transport Layer Protection}

^{URL url = new URL("http://example.com/data");}

^{HttpURLConnection connection = (HttpURLConnection) url.openConnection();}

^{InputStream in = connection.getInputStream();}

‍

In the example above, the application is sending sensitive information over an unencrypted connection, making it vulnerable to eavesdropping and other attacks. To properly protect sensitive information during transmission, developers should use secure protocols like HTTPS, which encrypts all data in transit between the device and the server. In the example above, developers should use https://example.com/data instead of http://example.com/data to properly secure their connection.