Top 10 2014-I7 Insecure Mobile Interface - Revision history

Yunsoul at 06:53, 5 February 2016

2016-02-05T06:53:45Z

2015-12-01T23:02:27Z

2015-08-18T00:12:30Z

2015-02-09T22:56:07Z

2015-02-05T21:59:09Z

2015-02-05T21:45:02Z

2014-06-29T21:33:20Z

2014-06-29T21:32:08Z

2014-06-29T21:09:25Z

2014-06-29T21:06:19Z

@@ Line 36: / Line 36: @@
 # Ensuring credentials are not exposed while connected to wireless networks
 # Implementing two factor authentication if possible
 Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer]

← Older revision		Revision as of 23:02, 1 December 2015
Line 1:		Line 1:
−	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=~~Top_IoT_Vulnerabilities~~ Back To The Internet of Things Top 10]</center>	+	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_10_IoT_Vulnerabilities__282014_29 Back To The Internet of Things Top 10]</center>

	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}

← Older revision		Revision as of 00:12, 18 August 2015
Line 1:		Line 1:
−	<center>[https://www.owasp.org/index.php/~~OWASP_Internet_of_Things_Top_Ten_Project~~#tab=~~OWASP_Internet_of_Things_Top_10_for_2014~~ Back To The Internet of Things Top 10]</center>	+	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_IoT_Vulnerabilities Back To The Internet of Things Top 10]</center>

	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}

@@ Line 22: / Line 22: @@
 {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Is My Mobile Interface Secure?|position=firstLeft|year=2013|language=en}}
-The easiest way to determine if your mobile interface is secure is by reviewing areas such as account enumeration, account lockout and whether credentials are exposed while connected to wireless networks.
+Checking for an Insecure Mobile Interface includes:
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Secure My Mobile Interface?|position=right|year=2013|language=en}}
@@ Line 28: / Line 33: @@
 # Default passwords and ideally default usernames to be changed during initial setup
 # Ensuring user accounts can not be enumerated using functionality such as password reset mechanisms
-# Ensuring account lockout after an appropriate number of tries
+# Ensuring account lockout after an 3 - 5 failed login attempts
 # Ensuring credentials are not exposed while connected to wireless networks
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
 '''Scenario #1:''' Password reset indicates whether account exist or not.
@@ Line 49: / Line 57: @@
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 {{Top_10_2010:SubSubsectionExternalReferencesTemplate}}

@@ Line 27: / Line 27: @@
 A secure mobile interface requires:
 # Default passwords and ideally default usernames to be changed during initial setup
-# Ensuring user accounts can not be enumerated using functionality such as password reset mechanisms.
+# Ensuring user accounts can not be enumerated using functionality such as password reset mechanisms
-# Ensuring account lockout after an appropriate number of tries.
+# Ensuring account lockout after an appropriate number of tries
-# Ensuring credentials are not exposed while connected to wireless networks.
+# Ensuring credentials are not exposed while connected to wireless networks
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
 '''Scenario #1:''' Password reset indicates whether account exist or not.

@@ Line 16: / Line 16: @@
 </td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider the business impact of an insecure mobile interface. Data could be stolen or modified and devices taken control of.  Could your users be harmed? Could your brand be harmed?
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider the business impact of an insecure mobile interface. Data could be stolen or modified and control over devices assumed. Could your customers be harmed? Could your brand be harmed?
 </td>

@@ Line 2: / Line 2: @@
 {{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
-{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=2|detectability=2|impact=1|year=2013|language=en}}
+{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=2|detectability=1|impact=1|year=2013|language=en}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the mobile application.
@@ Line 25: / Line 25: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Secure My Mobile Interface?|position=right|year=2013|language=en}}
-Ensuring a secure mobile interface requires:
+A secure mobile interface requires:
 # Ensuring user accounts can not be enumerated using functionality such as password reset mechanisms.
 # Ensuring account lockout after an appropriate number of tries.

@@ Line 10: / Line 10: @@
 </td>
-      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>An insecure mobile interface is present when easy to guess credentials are used or account enumeration is possible. Insecure mobile interfaces are easy to discover by simply reviewing the connection to the cloud interface and identifying if SSL is in use or by using the password reset mechanism to identify valid accounts which can lead to account enumeration.
+      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>An insecure mobile interface is present when easy to guess credentials are used or account enumeration is possible. Insecure mobile interfaces are easy to discover by simply reviewing the connection to the wireless networks and identifying if SSL is in use or by using the password reset mechanism to identify valid accounts which can lead to account enumeration.
 </td>