This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Mobile Top 10 2014-M10"

From OWASP
Jump to: navigation, search
(Created page with "{{Top_10_2010:SubsectionColoredTemplate|<center>Lack of Binary Protections</center>||year=2014}} {{Top_10_2010:SummaryTableHeaderBeginTemplate}} {{Top_10_2010:SummaryTableValu...")
 
Line 14: Line 14:
  
 
{{Top_10_2010:SubsectionColoredTemplate|Am I Vulnerable to Lack of Binary Protections?||year=2014}}
 
{{Top_10_2010:SubsectionColoredTemplate|Am I Vulnerable to Lack of Binary Protections?||year=2014}}
−
You mobile application can accept data from all kinds of sources. In most cases this will be an Inter Process Communication (IPC) mechanism. In general try and adhere to the following IPC design patterns:
 
  
−
* If there is a business requirement for IPC communication, the mobile application should restrict access to a white-list of trusted applications
+
The Lack of Binary Protections category considers many security protections (or lack thereof) that are easy to implement but often go unused for mobile applications. Most of these protections are chosen at compile time. In general you should be aware of the following for mobile applications when compiling for production:
−
* Sensitive actions which are triggered through IPC entry points should require user interaction before performing the action
+
 
−
* All input received from IPC entry points must undergo stringent input validation in order to prevent input driven attacks
+
* How to fully enable ASLR and Exploit mitigation protections.
−
* Do not pass any sensitive information through IPC mechanisms, as it may be susceptible to being read by third party applications under certain scenarios
+
* How to remove path and symbol information from the binary.
 +
* How to use/enable framework provided memory management (to avoid memory leaks and code quality issues).
 +
* How to implement simple certificate pinning.
 +
* How to implement simple jailbreak/root detection.
 +
* How to implement simple anti-debugging code.
 +
* How to implement framework provided code obfuscation.
 +
 
  
 
{{Top_10_2010:SubsectionColoredTemplate|How Do I Prevent Lack of Binary Protections?||year=2014}}
 
{{Top_10_2010:SubsectionColoredTemplate|How Do I Prevent Lack of Binary Protections?||year=2014}}
  
 
iOS Specific Examples:
 
iOS Specific Examples:
−
* Do not use the deprecated handleOpenURL method to handle URL Scheme calls. This method does not contain an argument containing the BundleID of the source application.
+
*  
−
** Instead use the openURL:sourceApplication:annotation method and validation the sourceApplication argument against a white-list of trusted applications
 
−
*Do not use the iOS Pasteboard for IPC communications, as it is susceptible to being set or read by all third party apps on the device. 
 
 
   
 
   
 
Android Specific Examples
 
Android Specific Examples
Line 35: Line 38:
 
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=7}}
 
{{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=7}}
 
References
 
References
−
 
−
[https://www.owasp.org/images/c/ca/ASDC12-An_InDepth_Introduction_to_the_Android_Permissions_Modeland_How_to_Secure_MultiComponent_Applications.pdf An In Depth Introduction to the Android Permissions Modeland How to Secure MultiComponent Applications]
 

Revision as of 07:51, 27 January 2014

Lack of Binary Protections
Threat Agents Attack Vectors Security Weakness Technical Impacts Business Impacts
Application Specific Exploitability
EASY		 Prevalence
COMMON		 Detectability
EASY		 Impact
SEVERE		 Application / Business Specific
Threat Description Attack Vector Description Security Weakness Description Technical Impacts Business Impacts
Am I Vulnerable to Lack of Binary Protections?


The Lack of Binary Protections category considers many security protections (or lack thereof) that are easy to implement but often go unused for mobile applications. Most of these protections are chosen at compile time. In general you should be aware of the following for mobile applications when compiling for production:

  • How to fully enable ASLR and Exploit mitigation protections.
  • How to remove path and symbol information from the binary.
  • How to use/enable framework provided memory management (to avoid memory leaks and code quality issues).
  • How to implement simple certificate pinning.
  • How to implement simple jailbreak/root detection.
  • How to implement simple anti-debugging code.
  • How to implement framework provided code obfuscation.


How Do I Prevent Lack of Binary Protections?


iOS Specific Examples:

Android Specific Examples


Example Scenarios

Example Scenarios


References

References

Retrieved from "https://wiki.owasp.org/index.php?title=Mobile_Top_10_2014-M10&oldid=166700"