Mobile Top 10 2012-M2 - Revision history

Jason Haddix at 21:09, 22 January 2014

2014-01-22T21:09:45Z

Jason Haddix at 21:09, 22 January 2014

2014-01-22T21:09:04Z

Jason Haddix at 21:06, 22 January 2014

2014-01-22T21:06:31Z

Jason Haddix at 21:00, 22 January 2014

2014-01-22T21:00:15Z

Jason Haddix at 20:48, 22 January 2014

2014-01-22T20:48:46Z

Jason Haddix at 19:52, 22 January 2014

2014-01-22T19:52:35Z

Jason Haddix: Created page with "{{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}} {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}..."

2013-01-24T00:19:31Z

Created page with "{{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}} {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}..."

New page

{{Top_10_2010:SummaryTableHeaderBeginTemplate}}
{{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}}
{{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}
{{Top_10_2010:SummaryTableValue-2-Template|Detectability|EASY}}
{{Top_10_2010:SummaryTableValue-1-Template|Impact|SEVERE}}
{{Top_10_2010:SummaryTableHeaderEndTemplate}}
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threat Description </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> Attack Vector Description </td>
<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Security Weakness Description </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Technical Impacts</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Business Impacts </td>
{{Top_10_2010:SummaryTableEndTemplate}}

{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=1|risk=2}}
Am I Vulnerable Description
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=2}}
How do I prevent
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=2}}
Example Scenarios
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=2}}
References

@@ Line 25: / Line 25: @@
 * Weakness due to cross-platform development and compilation
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=2}}
-Secure coding and configuration practices must be used on server-side of the mobile application. For specific vulnerability information refer to the OWASP Web Top Ten or Cloud Top Ten projects. We will try and link referenceshere to those projects and other OWASP projects that provide more robust descriptions.
+Secure coding and configuration practices must be used on server-side of the mobile application. For specific vulnerability information refer to the OWASP Web Top Ten or Cloud Top Ten projects. We will try and link references to those projects and other OWASP projects that provide more robust descriptions.
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=2}}

@@ Line 25: / Line 25: @@
 * Weakness due to cross-platform development and compilation
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=2}}
-Secure coding and configuration practices must be used on server-side of the mobile application. For specific vulnerability information refer to the OWASP Web Top Ten or Cloud Top Ten sections. We will try and link all things referenced here to those projects and possibly the OWASP Testing Guide.
+Secure coding and configuration practices must be used on server-side of the mobile application. For specific vulnerability information refer to the OWASP Web Top Ten or Cloud Top Ten projects. We will try and link referenceshere to those projects and other OWASP projects that provide more robust descriptions.
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=2}}

@@ Line 39: / Line 39: @@
-;Poor web services hardening
+;Poor Web Services Hardening
 : Logic flaws
 : Weak Authentication
 : Weak or no session management
 : Session fixation

@@ Line 28: / Line 28: @@
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=2}}
 If you look below, you can see that there is a ton of surface area to cover when thinking about M2:
@@ Line 35: / Line 34: @@
 [[File:CloudTT_thum.png|border|350px]][[File:WebTT_thumb.png|border|350px]]
 While we cannot go over all of these, what we can do is list vulnerability types that we see most often within mobile applications:

@@ Line 25: / Line 25: @@
 * Weakness due to cross-platform development and compilation
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=2}}
-Secure coding and configuration practices must be used on server-side of the mobile application. For specific vulnerability information refer to the OWASP Web Top Ten or Cloud top Ten sections. We will try and link all things referenced here to those projects and possibly the OWASP Testing guide.
+Secure coding and configuration practices must be used on server-side of the mobile application. For specific vulnerability information refer to the OWASP Web Top Ten or Cloud Top Ten sections. We will try and link all things referenced here to those projects and possibly the OWASP Testing Guide.
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=2}}
@@ Line 36: / Line 36: @@
-While we cannot go over all of these, what we can do is list vulnerability types that we see most often within M2:
+While we cannot go over all of these, what we can do is list vulnerability types that we see most often within mobile applications:

@@ Line 13: / Line 13: @@
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=1|risk=2}}
-Am I Vulnerable Description
+The M2 category is one that is always in heavy debate. It encompasses almost everything that a mobile application can do badly that does not take place on the phone. Which is exactly the argument… should it be listed at all? Don’t we have Top Ten lists for Web Applications? Don’t we have one for cloud too?
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=2}}
-How do I prevent
+Secure coding and configuration practices must be used on server-side of the mobile application. For specific vulnerability information refer to the OWASP Web Top Ten or Cloud top Ten sections. We will try and link all things referenced here to those projects and possibly the OWASP Testing guide.
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=2}}
-Example Scenarios
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=2}}
 References