In this month security experts had tested 275 Apple iOS- and Android-based mobile banking apps from 50 major financial institutions, 50 large regional banks, and 50 large U.S. credit unions.
They found that eight out of 10 apps were improperly configured and not built using best practices software development. Among the big-name banks whose mobile apps were tested by security firm Praetorian include Bank of America, Citigroup, Wells Fargo, Goldman Sachs, Morgan Stanley, Capital One Financial, and Suntrust Banks, but Praetorian did not disclose how each bank's apps fared in the tests.
Nathan Sportsman is founder and CEO of Praetorian says the security weaknesses in the mobile banking apps he and his team tested are not pure software vulnerabilities, so they are relatively low-risk issues that could ultimately lead to exploitation.
Praetorian's research comes at a time when mobile banking is starting to take off, albeit slowly. Some 35 percent of U.S. adults conduct mobile banking, up from 24 percent in 2012, according to the Pew Research Center. A new report by NSS Labs says some banks say they're seeing mobile banking grow by up to 70 percent per year.
Sportsman says "These aren't business logic or application-specific issues. They are weaknesses across the mobile apps: things developers should be doing" but they are not.
"This was not intrusive testing. We weren't looking for SQL injection, and would need permission to do that, so we were really looking at the configuration of the mobile apps,"
His firm hopes to next test these apps for how information gets stored on the local device.
The researchers tested for are well-known mitigation functions in software, and the tests were performed on the local device's mobile app, not back-end Web servers and services. Sportsman says the test only represents a snapshot of the full attack surface of mobile banking because between 75- to 90 percent of mobile banking occurs on the back-end.
Among the findings in the first test: Many of the iOS-based mobile banking apps did not have enabled Automatic Reference Counting (ARC), a memory management feature; Position Independent Executable, which prevents buffer overflows; and stack protection, which protects apps from "stack smashing."
Stack smashing and ASLR have been around a long time, and these should be enabled in the apps.Many of the Android-based mobile banking apps were discovered to be targeting older versions of the Android software development kits; lacking permission hardening; and with the debugging function enabled.
Large financial institutions not surprisingly faired better than credit unions or regional banks, but not dramatically: credit unions had 108 configuration weaknesses in their apps; regional banks, 97; and large financial institutions, 75.
They found that eight out of 10 apps were improperly configured and not built using best practices software development. Among the big-name banks whose mobile apps were tested by security firm Praetorian include Bank of America, Citigroup, Wells Fargo, Goldman Sachs, Morgan Stanley, Capital One Financial, and Suntrust Banks, but Praetorian did not disclose how each bank's apps fared in the tests.
Nathan Sportsman is founder and CEO of Praetorian says the security weaknesses in the mobile banking apps he and his team tested are not pure software vulnerabilities, so they are relatively low-risk issues that could ultimately lead to exploitation.
Praetorian's research comes at a time when mobile banking is starting to take off, albeit slowly. Some 35 percent of U.S. adults conduct mobile banking, up from 24 percent in 2012, according to the Pew Research Center. A new report by NSS Labs says some banks say they're seeing mobile banking grow by up to 70 percent per year.
Sportsman says "These aren't business logic or application-specific issues. They are weaknesses across the mobile apps: things developers should be doing" but they are not.
"This was not intrusive testing. We weren't looking for SQL injection, and would need permission to do that, so we were really looking at the configuration of the mobile apps,"
His firm hopes to next test these apps for how information gets stored on the local device.
The researchers tested for are well-known mitigation functions in software, and the tests were performed on the local device's mobile app, not back-end Web servers and services. Sportsman says the test only represents a snapshot of the full attack surface of mobile banking because between 75- to 90 percent of mobile banking occurs on the back-end.
Among the findings in the first test: Many of the iOS-based mobile banking apps did not have enabled Automatic Reference Counting (ARC), a memory management feature; Position Independent Executable, which prevents buffer overflows; and stack protection, which protects apps from "stack smashing."
Stack smashing and ASLR have been around a long time, and these should be enabled in the apps.Many of the Android-based mobile banking apps were discovered to be targeting older versions of the Android software development kits; lacking permission hardening; and with the debugging function enabled.
Large financial institutions not surprisingly faired better than credit unions or regional banks, but not dramatically: credit unions had 108 configuration weaknesses in their apps; regional banks, 97; and large financial institutions, 75.
No comments:
Post a Comment