Mobile Threat Defense:5 Things An App Provider Must Ensure
By Manish Mimani
Growing dependence on smartphone applications is accelerating and is almost irreversible. After the COVID outbreak, when all of us were compelled to stay indoors, mobile phones became a predominant medium for work, shopping, financial/non-financial transactions, information and entertainment. Mobile applications have witnessed widespread adoption with users’ expectations constantly rising at an advancing pace.
Numerous brands have joined the app wagon to strengthen their relationship with consumers and expand globally. Amidst the fast-growing app users and the app providers’ focus on making available the best possible user experience, the security aspects did not get the attention that was warranted. The cyber attackers saw this as a great opportunity and intensified their attacks through mobile devices and apps.
The only way for an app provider to survive such threats is to make the mobile app capable of identifying such threats and self-protect itself on a runtime basis. Before launching your mobile app for your end-users, esp. when your app is dealing with sensitive user data or financial transactions, ensure that your app is robust in respect of these 5 basic security elements :
Device & OS security
Smartphone users may have reasons to use rooted or jail-broken devices. Some might want to get rid of pre-loaded apps on their phones or some might want more control over their phones. It may be used to install ad blockers or play music with the screen locked. However, a rooted or a jailbroken device is vulnerable to attacks or malware where sensitive data of users can be easily stolen. App-providers, therefore, need to consider whether allowing their apps to run on a such devices will be safe for their users as well as for the enterprise. If not, arranging an appropriate security solution is a must. The security tool should also be able to detect whether the device has an up-to-date operating system and whether there is an attempt to open the app through emulators/simulators.
Application security
Apps can receive threats from a number of sources and the attackers are sitting right across to exploit the vulnerabilities to send malicious attacks and exploit user data. Reverse engineering is used by security researchers to find security risks in programs, but they are also used by hackers to attack and manipulate the applications. Two other means frequently deployed by fraudsters are luring mobile users to install apps from links provided in SMSes/emails or allowing mirroring of their device screen when the app is in use. Aim for providing security features in your apps so that the app itself detects such anomalies and initiates action as configured by the app provider organisation.
Network Security
Use of an unsecured network connection by your mobile app user can invite harmful attacks like Man-in-the-Middle (MITM), SSL stripping or fake certifications. Give peace of mind to your customers by equipping your app with the ability to detect an unsafe network and warn the user. Furthermore, your app should be able to detect proxy / VPN connections as also any fake certificates used for SSL decryption.
Malware Detection
Market reports indicate that India is amongst the countries with the highest no. of malware attacks on mobiles and that the security-breach incidents are increasing with the increased adoption of mobile payment by Indians. In recent weeks, mobile app users have been targeted by malware & trojans like Oscorp, Brata, SOVA, Drink etc. that defraud victims or steal critical data through remote access controls, keylogging, screen-recording & other breach techniques.
It is pertinent for mobile app-providing enterprises to ensure that their app has the capability to protect from App Spoofing Attacks when the App is launched. The app security solution should work all the time as long as App is alive and active to protect from Malware threats, not just on the launch of the App. Side-loaded apps and overlays during app usage are serious threats which must be managed effectively.
Security measures have to evolve
To add to the woes of app providers, the world of cyberattacks is constantly evolving with new methodologies to counter the security measures deployed already. The security measures deployed by app providers, therefore, can not be static. They must be reviewed and updated periodically. Any vulnerabilities identified during VAPT or Code Review must be addressed with promptness.
We all understand how security frameworks are important for systems to continue functioning without any lags or cyberattacks. When security is not considered a top priority from the initial stages, it paves the way for attacks at a later stage. It is required that the mobile banking apps are equipped with a Runtime Application Self-Protection (RASP) framework so that potential threats are addressed on a real-time basis. Mobile app providing Organisations can avail services of a specialized mobile threat defense (MTD) solution that is designed to not only fend off but also comprehensively protect the app from unknown threats on customers’ devices. This, along with strong customer awareness campaigns is required for a safe & secure digital adoption.