Positive Technologies has released its latest report, Vulnerabilities and Threats in Mobile Banking. Experts analyzed mobile banking applications and found half of mobile banks are vulnerable to fraud and theft of funds, with the server side accounting for more than half of all detected vulnerabilities.

None of the tested mobile banking applications had an acceptable level of security, with both client and server sides at risk. Client sides are especially vulnerable to unauthorized access to user data, as 43 percent of applications store important data on the phone in cleartext. The vast majority (76 percent) of mobile banking vulnerabilities can be exploited without physical access to the device. And more than a third of vulnerabilities can be exploited without administrator rights.

No flaws in iOS banking apps were worse than "medium" in severity. By comparison, 29 percent of Android apps contain high-risk vulnerabilities. The most dangerous vulnerabilities were found in Android applications and involve insecure deeplink handling. Developers on Android have more freedom of implementation, which explains the larger number of vulnerabilities in Android applications compared to iOS.

The server sides of mobile banking applications contain 54 percent of all vulnerabilities found and, on average, each mobile bank has 23 server side vulnerabilities. Almost half (43%) of banking applications contain server-side vulnerabilities in business logic, which attackers can exploit to obtain sensitive user information and commit fraud. Business logic errors may cause significant losses to banks and even lead to legal complications.

User credentials proved to be the most vulnerable data.

Positive Technologies analyst Olga Zinenko commented: "Banks are not protected from reverse engineering of their mobile apps. Moreover, they give short shrift to source code protection, store sensitive data on mobile devices in cleartext, and make errors allowing hackers to bypass authentication and authorization mechanisms and bruteforce user credentials. Through these vulnerabilities, hackers can obtain usernames, account balances, transfer confirmations, card limits, and the phone number associated with a victim's card.”

“We urge that banks do a better job of emphasizing application security throughout both design and development. Source code is rife with issues, making it vital to revisit development approaches by implementing SSDL practices and ensuring security at all stages of the application lifecycle.”

In 87 percent of cases, user interaction is required for a vulnerability to be exploited. Positive Technologies experts recommend that users avoid jailbreaking or rooting their devices, download applications only from official stores, avoid visiting suspicious websites or following dodgy links from SMS and chat messages, and always install the latest updates for OS and mobile applications.

You can download the full report, Vulnerabilities and Threats in Mobile Banking, here.

 

1. The experts analyzed 14 fully featured mobile banking applications for Android and iOS. The applications had been downloaded from official app stores (Google Play and Apple's App Store) more than 500,000 times. System owners agreed to use of security assessment results for research purposes.
2. The server side is a web application that interacts with the mobile client over the Internet by means of a special application programming interface (API). The client side refers to a mobile banking application installed on the user's device.
3. Deep linking is a technology that allows users to navigate between applications (or sections within an application) to a specific location using special links, similar to hyperlinks in web applications.