Guest post written by Charles Henderson
The history of mobile application security is a case of “two steps forward, one step back.” The rush of companies and developers into the mobile software market has led to shortcuts that have repeated many security problems already solved in older technology platforms. Mobile has been fraught with issues of caching sensitive data, incomplete encryption and simple mistakes in coding. The extreme portability of mobile devices and the relative ease of obtaining physical access pose a significantly new risk – which is why a top-of-the-line, soup-to-nuts data security plan is crucial when it comes to protecting sensitive information.
You may remember how secure the first PCs were in practice. As the 1980s charged on, more computer viruses were written and became an increasing problem until antivirus software was invented and eventually provided some degree of protection. When Tim Berners-Lee first invented the World Wide Web at CERN, security wasn’t an issue. As websites evolved into web applications, attackers became increasingly sophisticated and clever. The last decade of the 20th century and the early part of the 21st century have seen vulnerabilities like SQL injection make headlines as hackers have stolen millions of credit-card numbers at a time. But web application security caught up and a well-defined set of practices now exists to protect sensitive data. Now we need that same caliber of security for mobile applications, and we still have a long way to go.
Trustwave security experts test many mobile applications every year, usually fitting into one of two categories: free merchant or service-provider applications targeting consumer users (mobile banking applications, grocery store applications, etc.) and applications used by brick-and- mortar merchants for roving sales clerks. A small card reader that often plugs into the headphone jack can turn a tablet or mobile phone into a hand-held cashless register. And, unlike traditional cash registers, a mobile device can easily be slipped under a coat and carried out of the store for offline analysis. How do we prevent that potential compromise?
Whenever credit-card numbers are in play, encryption is obviously a must. The best design for a mobile credit-card reader is to embed the encryption function into the actual magnetic stripe hardware. This prevents any plain text card numbers from being saved to the device’s storage. This is the most common design, but we still test some applications that encrypt the card number on the mobile device. These alternate designs have the potential to allow malware on the device to intercept the card number before it is encrypted by the software running on the mobile device.
Caching is a wonderful feature that most consumers don’t even know exists. When used properly, it can provide significant performance improvements to mobile applications, particularly when running on slower or older networks. When abused by programmers, sensitive data can be cached by applications. For example, your online banking username and password, checking routing and account number, account history and so on. Granted, your mobile banking application will load much faster, but if you lose your phone, that information will be available to anyone who finds it.
Another problem that we often see is related to other features that most users are unaware of. Many tools and utilities exist to make the development process of mobile applications easier for the programmers. Those tools are great during the testing process, but should always be removed before the product is released to users. A good example is the logging of sensitive data by mobile applications. Trustwave recently tested an otherwise secure banking application that wrote full debit card data, including card numbers, expiration dates and security code, to the phone’s log file in plain text. Reading the data was trivial once the phone was “jailbroken” – no in-depth hacking skills were required.
To protect themselves, at the very least, businesses need to be cautious about what applications are installed on mobile devices used by employees. If a company is developing its own mobile applications (internally or by an external party), third-party security testing is critical. Similarly, any mobile application used to handle sensitive corporate data needs to be thoroughly tested first.
The best advice for consumers is to treat your smart phone like your wallet. Be careful what you keep on it and if you lose it, immediately start thinking about your risk exposure. Resetting passwords is usually easy to do and should be a high priority. Think about what credit-card numbers might be cached on your phone and consider calling your bank to have a new one issued. Most importantly, eat your way through your favorite application’s payment account before someone else does.