Virtually no mobile phone app is safe from data theft: report

[silversurfer]

Content source

https://www.scmagazine.com/home/security-news/virtually-no-mobile-phone-app-is-safe-from-data-theft-report/

More than three-fourths (76 percent) of mobile banking vulnerabilities can be exploited without physical access to the device is just one of numerous sobering findings from Positive Technologies in a report released today.

The research, which began in 2019, did not name the banks or the apps that have been downloaded more than 500,000 times each from Google Play and Apple’s App Store. [....]

Generally, iOS devices fared better than Android with Apple apps rating no vulnerabilities “worse than medium,” but they still were still deficient. By contrast, Android banking apps contained “high-risk” vulnerabilities.

Positive Technologies stated that the reason why 100 percent of banking clients contain code vulnerabilities is that they don’t protect against code injection and repackaging. In addition, the code contains the names of classes and methods.

The report noted that all attackers need to do to exploit code vulnerabilities is download the application from Google Play or the App Store and then decompile it.

Vulnerabilities and threats in mobile banking

In 2019, we chose 14 fully featured mobile banking applications for our research. This report summarizes client- and server-side vulnerabilities in mobile banking applications related to faults in application code, client–server interaction, and implementation of security mechanisms. None of the...

www.ptsecurity.com

 

[Gandalf_The_Grey]

Vulnerabilities and threats in mobile banking

In 2019, we chose 14 fully featured mobile banking applications for our research. This report summarizes client- and server-side vulnerabilities in mobile banking applications related to faults in application code, client–server interaction, and implementation of security mechanisms. None of the...

www.ptsecurity.com

What users should know
All mobile banking applications have security flaws. Our research shows that Android apps are more vulnerable than iOS ones. The vulnerabilities that hackers exploit for fraud and theft are usually the result of coding errors. Avoiding such flaws should be top priority for developers. However, many vulnerabilities cannot be exploited without user interaction. Some attacks require physical access to the device.

Rooting (Android) or jailbreaking (iOS) a device, or not setting a PIN code to unlock the phone, gives attackers more leverage to conduct malicious actions.

Tip for users
Do not jailbreak or root your device. This opens up access to the device file system and disables data protection mechanisms. Set a PIN code to unlock your device. This limits attackers' options even if they have physical access to your phone.

Some attacks require user interaction in the form of clicking a link, installing malware, or entering data on a fake web page.

Tip for users
Do not open links sent by strangers via SMS or chat. Never sideload applications from unofficial sources. Download applications only from official stores like Google Play and the App Store. When deciding what to download, pay attention to information on the app developer and the number of downloads.

Vulnerabilities can also reside in the mobile OS itself. But Google and Apple constantly update their software and release security patches. Users should remember that vulnerabilities become public after fixes are released. Hackers can make use of this to attack devices that don't have the latest updates installed.

Tip for users
Always install the latest updates for your OS and mobile applications.

 

[Vitali Ortzi]

When some games are better at making it harder for some fuzzers to extract plain code in them then most banking apps .
What a time to be alive