Security analysis of mobile banking apps reveals significant weaknesses

Many apps failed to validate SSL certificates and exposed sensitive information, a researcher from IOActive said

A security analysis of mobile banking apps for iOS devices from 60 financial institutions around the world has revealed that many were vulnerable to various attacks and exposed sensitive information.

Ariel Sanchez, a consultant at security firm IOActive, analyzed how the banking apps communicate with servers, how they store data locally, whether they were compiled with security options, what information they expose through logs and whether they have vulnerabilities in their code.

The researcher found that all tested applications could be installed and run on jailbroken devices. This is a security risk in itself, because jailbreaking circumvents iOS protections and allows apps running on the device to access the restricted resources of other apps that would normally be inaccessible on non-jailbroken devices.

While banking apps generally use SSL encryption for sensitive communications, Sanchez found that 90 percent of the tested apps also initiated several non-encrypted connections during their operation. This allows attackers who can intercept that traffic -- for example on an insecure wireless network -- to inject arbitrary JavaScript or HTML code into it, for example to display fake login prompts to the app's user or to launch other social engineering attacks.

In addition, even when using encryption, 40 percent of the tested apps did not validate the authenticity of digital certificates they received from the server, making them vulnerable to man-in-the-middle attacks using fake certificates.

Fifty percent of the tested apps implemented UIWebView, an iOS feature for displaying Web content in applications, in an insecure way, making them vulnerable to JavaScript injections (cross-site scripting), Sanchez said in a blog post. In some cases, native iOS functionality was exposed to the UIWebView, allowing actions such as sending SMS or emails from the victim's device, he said.

Sanchez presented an example where a rogue HTML form was injected into a vulnerable UIWebView implementation from one of the apps. That form was designed to trick the user into entering their username and password and then send them back to the attacker.

"Another concern brought to my attention while doing the research was that 70% of the apps did not have any alternative authentication solutions, such as multi-factor authentication, which could help to mitigate the risk of impersonation attacks," Sanchez said.

Many apps exposed sensitive information such as usernames and passwords and hidden URL paths that could expose the back-end server structure through the iOS system log. Other apps exposed information through their crash reports, which could help attackers find and develop exploits for them, and some apps had credentials hard-coded directly into their code.

"After taking a close look at the file system of each app, some of them used an unencrypted SQLite database and stored sensitive information, such as details of customer's banking account and transaction history," Sanchez said. "An attacker could use an exploit to access this data remotely, or if they have physical access to the device, could install jailbreak software in order to steal to the information from the file system of the victim's device."

Twenty percent of the tested apps hadn't been compiled with Position Independent Executable (PIE) and Stack Smashing Protection enabled, features that are designed to mitigate the risk of memory corruption attacks.

Sanchez didn't name any of the banks whose applications were found to be vulnerable, but he said some of them had been notified of the findings. A map shared by Sanchez suggests the tested apps have a global distribution, belonging to banks that operate in North America, South America, Europe, Africa, the Middle East, Asia and Australia.

"Home banking apps that have been adapted for mobile devices, such as smart phones and tablets, have created a significant security challenge for worldwide financial firms," Sanchez said. "As this research shows, financial industries should increase the security standards they use for their mobile home banking solutions."

Based on his findings, Sanchez made some recommendations for developers of mobile banking apps, such as ensuring all connections are made using secure transfer protocols; enforcing SSL certificate validation; encrypting sensitive data stored by the applications by using the iOS data protection API; improving jailbreaking detection; obfuscating the assembly code and using antidebugging techniques to slow reverse-engineering attempts; removing debugging statements and information and removing all development information from the final products.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags securitymobile securityAccess control and authenticationencryptionExploits / vulnerabilitiesdata protectionprivacyIOActive

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?