Mobile Top 10 2012-M1 Insecure Data Storage - Revision history

Jason Haddix at 08:53, 29 January 2013

2013-01-29T08:53:50Z

Jason Haddix at 08:32, 29 January 2013

2013-01-29T08:32:44Z

Jason Haddix at 04:34, 24 January 2013

2013-01-24T04:34:58Z

Jason Haddix at 23:07, 23 January 2013

2013-01-23T23:07:38Z

Jason Haddix at 22:52, 23 January 2013

2013-01-23T22:52:36Z

Jason Haddix at 20:20, 23 January 2013

2013-01-23T20:20:55Z

Jason Haddix at 20:20, 23 January 2013

2013-01-23T20:20:06Z

Jason Haddix at 20:19, 23 January 2013

2013-01-23T20:19:42Z

Jason Haddix: moved Mobile Top 10 2012-M1 to Mobile Top 10 2012-M1 Insecure Data Storage

2013-01-23T20:16:33Z

moved Mobile Top 10 2012-M1 to Mobile Top 10 2012-M1 Insecure Data Storage

Jason Haddix: Created page with "{{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}} {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}..."

2013-01-23T20:05:23Z

Created page with "{{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}} {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}..."

New page

{{Top_10_2010:SummaryTableHeaderBeginTemplate}}
{{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}}
{{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}
{{Top_10_2010:SummaryTableValue-2-Template|Detectability|EASY}}
{{Top_10_2010:SummaryTableValue-1-Template|Impact|SEVERE}}
{{Top_10_2010:SummaryTableHeaderEndTemplate}}
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threats Agents include lost/stolen phones and the possibility of in-the-wild exploit/malware gaining access to the device. </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> A malicious agent hooks up an unprotected device to a computer with commonly available software. They are able to see all third party application directories that often contain stored personal information. </td>
<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>M1, insecure data storage, occurs when development teams assume that users will not have access to the phones file system. Devices file systems are often accessible easily and you should expect a malicious user to be inspecting your data stores. Rooting or jailbreaking a device usually circumvents any encryption protections and in some cases, where data is not protected properly, all that is needed to view application data is to hook the phone up to a computer and use some specialized tools. </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Insecure data storage can result in data loss, in the best case, for one user. In the worst case, for many users. Common valuable pieces of data seen stored include:
* Usernames
* Authentication tokens
* Passwords
* Cookies
* Location data
* UDID/EMEI, Device Name, Network Connection Name
* Personal Information: DoB, Address, Social, Credit Card Data
* Application Data:
** Stored application logs
** Debug information
** Cached application messages
** Transaction histories </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> Insert text here </td>
{{Top_10_2010:SummaryTableEndTemplate}}

{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=1|risk=1}}

@@ Line 48: / Line 48: @@
 * For items stored in the keychain leverage the most secure API designation, kSecAttrAccessibleWhenUnlocked (now the default in iOS 5) and for enterprise managed mobile devices ensure a strong PIN is forced, alphanumeric, larger than 4 characters.
 * For larger or more general types of consumer-grade data, Apple’s File Protection mechanism can safely be used (see NSData Class Reference for protection options).
-* Avoid using NSUserDefaults to store senstitve pieces of information
+* Avoid using NSUserDefaults to store senstitve pieces of information as it stores data in plist files.
 * Be aware that all data/entities using NSManagedObects will be stored in an unencrypted database file.

← Older revision		Revision as of 08:32, 29 January 2013
Line 73:		Line 73:
	* [http://developer.android.com/guide/topics/security Google Androids Developer Security Topics 2]		* [http://developer.android.com/guide/topics/security Google Androids Developer Security Topics 2]
	* [https://developer.apple.com/library/mac/ Apple's Introduction to Secure Coding]		* [https://developer.apple.com/library/mac/ Apple's Introduction to Secure Coding]
		+	* [http://h30499.www3.hp.com/t5/Application-Security-Fortify-on/Exploring-The-OWASP-Mobile-Top-10-M1-Insecure-Data-Storage/ba-p/5904609 Fortify On Demand Blog - Exploring The OWASP Mobile Top 10: M1 Insecure Data Storage]

@@ Line 36: / Line 36: @@
 * Cloud synced
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=1}}
 '''iOS Specific Best Practices:'''

@@ Line 63: / Line 63: @@
 Here we have iGoat, a purposefully vulnerable mobile app for security conscious folk to see these types of vulnerabilities first hand. In the exercise we enter our credentials, and log in to the fake bank app. We can then navigate to the file system and in our applications directory we can see a database called “credentials.sqlite”. Exploring this database reveals our username and credentials (Jason:pleasedontstoremebro!) being stored in plain text.
-''' [[Image:Screen%20Shot%202012-12-19%20at%206.34.23%20AM.png]]'''
+[[Image:Screen%20Shot%202012-12-19%20at%206.34.23%20AM.png]]
 [[Image:Screen%20Shot%202012-12-19%20at%206.44.51%20AM.png]]
 [[Image:Screen%20Shot%202012-12-19%20at%2010.11.15%20AM.png]]

@@ Line 5: / Line 5: @@
 {{Top_10_2010:SummaryTableValue-1-Template|Impact|SEVERE}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate}}
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threats Agents include lost/stolen phones and the possibility of in-the-wild exploit/malware gaining access to the device. </td>
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threats agents include lost/stolen phones and the possibility of in-the-wild exploit/malware gaining access to the device. </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> A malicious agent hooks up an unprotected device to a computer with commonly available software. They are able to see all third party application directories that often contain stored personal information. </td>
       <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>M1, insecure data storage, occurs when development teams assume that users will not have access to the phones file system and store sensitive pieces of information in data-stores on the phone. Devices file systems are often easily accessible and you should expect a malicious user to be inspecting your data stores. Rooting or jailbreaking a device usually circumvents any encryption protections and in some cases, where data is not protected properly, all that is needed to view application data is to hook the phone up to a computer and use some specialized tools. </td>
@@ Line 25: / Line 25: @@
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=1|risk=1}}

@@ Line 7: / Line 7: @@
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threats Agents include lost/stolen phones and the possibility of in-the-wild exploit/malware gaining access to the device. </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> A malicious agent hooks up an unprotected device to a computer with commonly available software. They are able to see all third party application directories that often contain stored personal information. </td>
-      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>M1, insecure data storage, occurs when development teams assume that users will not have access to the phones file system and store sensitive pieces of information in data-stores on the phone. Devices file systems are often accessible easily and you should expect a malicious user to be inspecting your data stores. Rooting or jailbreaking a device usually circumvents any encryption protections and in some cases, where data is not protected properly, all that is needed to view application data is to hook the phone up to a computer and use some specialized tools. </td>
+      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>M1, insecure data storage, occurs when development teams assume that users will not have access to the phones file system and store sensitive pieces of information in data-stores on the phone. Devices file systems are often easily accessible and you should expect a malicious user to be inspecting your data stores. Rooting or jailbreaking a device usually circumvents any encryption protections and in some cases, where data is not protected properly, all that is needed to view application data is to hook the phone up to a computer and use some specialized tools. </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Insecure data storage can result in data loss, in the best case, for one user. In the worst case, for many users. Common valuable pieces of data seen stored include:
 * Usernames

← Older revision	Revision as of 20:16, 23 January 2013
(No difference)