Mobile Top 10 2014-M4 - Revision history

Stephencor at 07:03, 8 October 2014

2014-10-08T07:03:29Z

Jonathan Carter at 00:21, 10 April 2014

2014-04-10T00:21:43Z

Jason Haddix at 08:48, 27 January 2014

2014-01-27T08:48:45Z

Jason Haddix at 07:34, 27 January 2014

2014-01-27T07:34:00Z

Jason Haddix at 06:45, 27 January 2014

2014-01-27T06:45:00Z

Jason Haddix at 05:22, 27 January 2014

2014-01-27T05:22:09Z

Jason Haddix: Created page with "{{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}} {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}..."

2014-01-27T05:11:51Z

Created page with "{{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}} {{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}..."

New page

{{Top_10_2010:SummaryTableHeaderBeginTemplate}}
{{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}}
{{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}
{{Top_10_2010:SummaryTableValue-2-Template|Detectability|EASY}}
{{Top_10_2010:SummaryTableValue-1-Template|Impact|SEVERE}}
{{Top_10_2010:SummaryTableHeaderEndTemplate}}
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threat Description </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> Attack Vector Description </td>
<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Security Weakness Description </td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Technical Impacts</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Business Impacts </td>
{{Top_10_2010:SummaryTableEndTemplate}}

{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=1|risk=8}}
Unintended data leakage (formerly side-channel data leakage) is a branch of Insecure Data Storage. It includes all manner of vulnerabilities that can be introduced by the OS, frameworks, compiler environment, new hardware, etc, all without a developers knowledge.

In the mobile development world this is most seen in undocumented internal processes such as:

* The way the OS caches data, images, key-presses, logging, and buffers.
* The way the development framework caches data, images, key-presses, logging, and buffers.
* The way or amount of data ad, analytic, social, or enablement frameworks cache data, images, key-presses, logging, and buffers.

{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=8}}
How do I prevent
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=8}}
Example Scenarios
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=8}}
References

@@ Line 9: / Line 9: @@
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Agents that may exploit this vulnerability include the following: mobile malware, modified versions of legitimate apps, or an adversary that has physical access to the victim's mobile device.</td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>An agent that has physical access to the device will use freely available forensic tools to conduct the attack. An agent that has access to the device via malicious code will use fully permissible and documented API calls to conduct this attack.</td>
-      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Unintended data leakage occurs when a developer inadvertantly places sensitive information or data in a location on the mobile device that is easily accessible by other apps on the device. First, a developer's code processes sensitive information supplied by the user or the backend. During that processing, a side-effect (that is unknown to the developer) results in that information being placed into an insecure location on the mobile device that other apps on the device may have open access to. Typically, these side-effects originate from the underlying mobile device's operating system (OS). This will be a very prevalent vulnerability for code produced by a developer that does not have intimate knowledge of how that information can be stored or processed by the underlying OS.
+      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Unintended data leakage occurs when a developer inadvertently places sensitive information or data in a location on the mobile device that is easily accessible by other apps on the device. First, a developer's code processes sensitive information supplied by the user or the backend. During that processing, a side-effect (that is unknown to the developer) results in that information being placed into an insecure location on the mobile device that other apps on the device may have open access to. Typically, these side-effects originate from the underlying mobile device's operating system (OS). This will be a very prevalent vulnerability for code produced by a developer that does not have intimate knowledge of how that information can be stored or processed by the underlying OS.
 It is easy to detect data leakage by inspecting all mobile device locations that are accessible to all apps for the app's sensitive information.</td>
@@ Line 24: / Line 24: @@
 Unintended data leakage (formerly side-channel data leakage) includes vulnerabilities from the OS, frameworks, compiler environment, new hardware, etc. without a developers knowledge.
-In mobile development, this is most seen in undocumented (or under-documeted) internal processes such as:
+In mobile development, this is most seen in undocumented (or under-documented) internal processes such as:
 * The way the OS caches data, images, key-presses, logging, and buffers.

@@ Line 7: / Line 7: @@
 {{Top_10_2010:SummaryTableValue-1-Template|Impact|SEVERE}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate}}
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Threat Description </td>
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Agents that may exploit this vulnerability include the following: mobile malware, modified versions of legitimate apps, or an adversary that has physical access to the victim's mobile device.</td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}> Attack Vector Description </td>
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>An agent that has physical access to the device will use freely available forensic tools to conduct the attack. An agent that has access to the device via malicious code will use fully permissible and documented API calls to conduct this attack.</td>
-      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Security Weakness Description </td>
+      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Unintended data leakage occurs when a developer inadvertantly places sensitive information or data in a location on the mobile device that is easily accessible by other apps on the device. First, a developer's code processes sensitive information supplied by the user or the backend. During that processing, a side-effect (that is unknown to the developer) results in that information being placed into an insecure location on the mobile device that other apps on the device may have open access to. Typically, these side-effects originate from the underlying mobile device's operating system (OS). This will be a very prevalent vulnerability for code produced by a developer that does not have intimate knowledge of how that information can be stored or processed by the underlying OS.
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Technical Impacts</td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Business Impacts </td>
+It is easy to detect data leakage by inspecting all mobile device locations that are accessible to all apps for the app's sensitive information.</td>
 {{Top_10_2010:SummaryTableEndTemplate}}
 {{Top_10_2010:SubsectionColoredTemplate|Am I Vulnerable to Unintended Data Leakage?||year=2014}}
-Unintended data leakage (formerly side-channel data leakage) is a branch of Insecure Data Storage. It includes all manner of vulnerabilities that can be introduced by the OS, frameworks, compiler environment, new hardware, etc, all without a developers knowledge.
+Unintended data leakage (formerly side-channel data leakage) includes vulnerabilities from the OS, frameworks, compiler environment, new hardware, etc. without a developers knowledge.
-In the mobile development world this is most seen in undocumented (or under-documeted) internal processes such as:
+In mobile development, this is most seen in undocumented (or under-documeted) internal processes such as:
 * The way the OS caches data, images, key-presses, logging, and buffers.
@@ Line 36: / Line 43: @@
-It is especially important to discern what a given OS or framework does by default. By identifying this and applying mitigating controls, you can avoid unintended data leakage. Specific examples to follow.
+It is especially important to discern what a given OS or framework does by default. By identifying defaults and applying mitigating controls, you can avoid unintended data leakage.
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=8}}

← Older revision		Revision as of 08:48, 27 January 2014
Line 1:		Line 1:
		+	<center>[https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks Back To The Mobile Top Ten Main Page]</center>
	{{Top_10_2010:SubsectionColoredTemplate\|<center>Unintended Data Leakage</center>\|\|year=2014}}		{{Top_10_2010:SubsectionColoredTemplate\|<center>Unintended Data Leakage</center>\|\|year=2014}}
	{{Top_10_2010:SummaryTableHeaderBeginTemplate}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate}}

← Older revision		Revision as of 07:34, 27 January 2014
Line 1:		Line 1:
		+	{{Top_10_2010:SubsectionColoredTemplate\|<center>Unintended Data Leakage</center>\|\|year=2014}}
	{{Top_10_2010:SummaryTableHeaderBeginTemplate}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate}}
	{{Top_10_2010:SummaryTableValue-1-Template\|Exploitability\|EASY}}		{{Top_10_2010:SummaryTableValue-1-Template\|Exploitability\|EASY}}

@@ Line 12: / Line 12: @@
 {{Top_10_2010:SummaryTableEndTemplate}}
-{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=1|risk=8}}
+{{Top_10_2010:SubsectionColoredTemplate|Am I Vulnerable to Unintended Data Leakage?||year=2014}}
 Unintended data leakage (formerly side-channel data leakage) is a branch of Insecure Data Storage. It includes all manner of vulnerabilities that can be introduced by the OS, frameworks, compiler environment, new hardware, etc, all without a developers knowledge.
@@ Line 21: / Line 21: @@
 * The way or amount of data ad, analytic, social, or enablement frameworks cache data, images, key-presses, logging, and buffers.
-{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=8}}
+{{Top_10_2010:SubsectionColoredTemplate|How Do I Prevent Unintended Data Leakage?||year=2014}}
 It is important to threat model your OS, platforms, and frameworks, to see how they handle the following types of features:

@@ Line 15: / Line 15: @@
 Unintended data leakage (formerly side-channel data leakage) is a branch of Insecure Data Storage. It includes all manner of vulnerabilities that can be introduced by the OS, frameworks, compiler environment, new hardware, etc, all without a developers knowledge.
-In the mobile development world this is most seen in undocumented internal processes such as:
+In the mobile development world this is most seen in undocumented (or under-documeted) internal processes such as:
 * The way the OS caches data, images, key-presses, logging, and buffers.
@@ Line 22: / Line 22: @@
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=2|risk=8}}
-How do I prevent
+It is important to threat model your OS, platforms, and frameworks, to see how they handle the following types of features:
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=3|risk=8}}
-Example Scenarios
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=8}}
 References