Mobile Top 10 2012-M4 Client Side Injection - Revision history

Jason Haddix at 09:03, 18 February 2013

2013-02-18T09:03:07Z

Jason Haddix at 08:35, 18 February 2013

2013-02-18T08:35:54Z

Jason Haddix at 08:35, 18 February 2013

2013-02-18T08:35:33Z

Jason Haddix: moved Mobile Top 10 2012-M4 to Mobile Top 10 2012-M4 Client Side Injection

2013-02-18T07:36:32Z

moved Mobile Top 10 2012-M4 to Mobile Top 10 2012-M4 Client Side Injection

Jason Haddix at 07:35, 18 February 2013

2013-02-18T07:35:46Z

Jason Haddix: Created page with "{{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}} {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}..."

2013-01-24T00:20:36Z

Created page with "{{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}} {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}..."

New page

{{Top_10_2010:SummaryTableHeaderBeginTemplate}}
{{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}}
{{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}
{{Top_10_2010:SummaryTableValue-2-Template|Detectability|EASY}}
{{Top_10_2010:SummaryTableValue-1-Template|Impact|SEVERE}}
{{Top_10_2010:SummaryTableHeaderEndTemplate}}
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threat Description </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> Attack Vector Description </td>
<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Security Weakness Description </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Technical Impacts</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Business Impacts </td>
{{Top_10_2010:SummaryTableEndTemplate}}

{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=1|risk=4}}
Am I Vulnerable Description
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=4}}
How do I prevent
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=4}}
Example Scenarios
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=4}}
References

@@ Line 57: / Line 57: @@
 * '''JavaScript Injection (XSS):''' Verify that JavaScript and Plugin support is disabled for any WebViews (usually the default).
 * '''Local File Inclusion:'''  Verify that File System Access is disabled for any WebViews (webview.getSettings().setAllowFileAccess(false);).
+* '''Intent Injection/Fuzzing:''' Verify actions and data are validated via an Intent Filter for all Activities.
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=4}}
 Example Scenarios

← Older revision		Revision as of 08:35, 18 February 2013
Line 52:		Line 52:

	'''Android Specific Best Practices:'''		'''Android Specific Best Practices:'''
		+

	* '''SQL Injection:''' When dealing with dynamic queries or Content-Providers ensure you are using parameterized queries.		* '''SQL Injection:''' When dealing with dynamic queries or Content-Providers ensure you are using parameterized queries.

@@ Line 53: / Line 53: @@
 '''Android Specific Best Practices:'''
+* '''SQL Injection:''' When dealing with dynamic queries or Content-Providers ensure you are using parameterized queries.
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=4}}
@@ Line 63: / Line 65: @@
 [http://www.youtube.com/watch?v=FJvyLUjbAy0 Ilja Van Sprundel – Auditing iPhone and iPad Applications]

← Older revision	Revision as of 07:36, 18 February 2013
(No difference)

@@ Line 3: / Line 3: @@
 {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}
 {{Top_10_2010:SummaryTableValue-2-Template|Detectability|EASY}}
-{{Top_10_2010:SummaryTableValue-1-Template|Impact|SEVERE}}
+{{Top_10_2010:SummaryTableValue-1-Template|Impact|MODERATE}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate}}
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threat Description </td>
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Consider anyone who can send untrusted data to the system, including external users, internal users, and the application itself.  </td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> Attack Vector Description </td>
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> Attacker loads simple text-based attacks that exploit the syntax of the targeted interpreter. Almost any source of data can be an injection vector, including resource files or the application itself. </td>
-      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Security Weakness Description </td>
+      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Client Side Injection for Mobile Applications is a mixed bag. To properly determine the Impact you must threat model the application. Injection attacks such as SQL Injection on client devices can be severe if your application deals with more than one user account on a single application or a shared device, or paid-for-only content. Other injection points are meant to overflow applications components but are less likely to achieve a high impact result because of the managed code protections of the application languages. </td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Technical Impacts</td>
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>As stated the Impact of client side injections can vary depending on the type of data or type of the application. </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Business Impacts </td>
 {{Top_10_2010:SummaryTableEndTemplate}}
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=1|risk=4}}
-Am I Vulnerable Description
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=4}}
-How do I prevent
+In general, protecting you application from client side injection requires looking at all the areas your application can receive data from and applying some sort of input validation. In certain cases this is simple but for others it is more complex, see below:
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=4}}
 Example Scenarios
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=4}}
-References
+[https://developer.apple.com/library/mac/#documentation/security/conceptual/SecureCodingGuide Apple’s Secure Coding Guide]