Most enterprise mobile apps are vulnerable to common exploits, warns HP

SQL injection, cross-site scripting holes continue to plague mobile apps
Tools

Almost all of the enterprise mobile apps examined by HP Fortify accessed at least one private information source within a device, and 86 percent did not have adequate security measures to guard against common exploits.

These exploits included misuse of encrypted data, cross-site scripting attacks and insecure transmission of data, the study of 2,100 mobile apps deployed by Forbes Global 2000 companies found.

"Software has a tendency to be pushed out there when it's all about the features and performance. Get it out there to a broad set of users and refine it over time," says Mike Armistead, vice president and general manager of enterprise security products at HP Fortify. "Today, it is almost irresponsible to be thinking that way because you have adversaries that are manipulating this software... You have to think about security as well as about features and performance," Armistead tells FierceMobileIT.

"There are vulnerabilities that are not being taken care of. That is because software developers aren't steeped in security. It is getting better over time, but traditionally it's been about developing features and functions on time," Armistead relates.

"Today, things like SQL injection and cross-site scripting can be discovered… They are old kinds of vulnerabilities and we shouldn't be making these kinds of mistakes anymore. So it is up to these enterprises to do the right thing," Armistead advises.

According to the study, three-quarters of mobile apps did not use strong encryption when storing data on mobile devices, which exposes passwords, personal information, session tokens, documents, chat logs, photos and other data to an attacker.

"Unencrypted data that is seen and used by a malicious attacker can violate numerous corporate governance policies as well as compromise the reputation of the enterprise if sensitive trade secrets are leaked to competitors, the media or any other variety of recipients with negative consequences," cautions HP in its release.

In addition, 86 percent of mobile apps tested did not have binary hardening, which opens them up to information disclosure, buffer overflows and poor performance.

Around 18 percent of mobile apps sent usernames and passwords over the insecure HTTP application-level protocol. Of the remaining mobile apps, another 18 percent incorrectly implemented the secure SSL/HTTPs protocol.

"These unprotected credentials are typically used not only for the mobile applications but also by their web application counterparts. This further compounds the issue, since malicious attackers on the same network could then sniff that data," HP adds.

For more:
- see HP's release
- check out the study's microsite

Related Articles:
Enterprise mobility fuels demand for mobile app development platform vendors
IT pros fret about corporate mobile app security