1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[390],{1096:function(e,t,a){(window.__NEXT_P=window.__NEXT_P||[]).push(["/about-us/blog/in-app-protection",function(){return a(8345)}])},8345:function(e,t,a){"use strict";a.r(t),a.d(t,{default:function(){return r}});var n=a(5893),i=a(9008),s=a.n(i),o=a(2812);function r(){return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsxs)(s(),{children:[(0,n.jsx)("title",{children:"In-App Protection - CYBERCRYPT"}),(0,n.jsx)("meta",{property:"og:title",content:"Application Security is Getting Worse, not Better"})]}),(0,n.jsx)(o.Z,{page:"about"}),(0,n.jsx)("div",{dangerouslySetInnerHTML:{__html:'\n \n <main>\n \n \n <meta property=\'og:title\' content=\'In-App Protection\' />\n <meta property=\'og:image\' content=\'/media/awwm5q2h/appsec.png\' /><meta property=\'og:description\' content=\'Application Security is Getting Worse, not Better\' /><meta property=\'og:url\' content=\'/\' />\n \n <section class="blogpost module-common" data-changed-bg-class=--dark-blue data-changed-btn-class=--light>\n <div class="blogpost-container">\n \n <div class="row">\n <p class="blogpost-heading">\n Application Security is Getting Worse, not Better </p>\n <div class="blogpost-date-wrapper">\n <p class="blogpost-date">\n December 21, 2020 </p>\n \n \n \n </div>\n \n <div class="row">\n <p>\n <div class="col-12 blogpost-image-wrapper"><img src="/media/awwm5q2h/appsec.png" class="blogpost-img" /></div> </p>\n <p class="blogpost-preamble">\n Web and mobile application use has exploded in recent years as businesses have digitized and moved more of their operations to the cloud, and as the number of mobile devices has proliferated. Application breaches have increased commensurately, and show no signs of slowingâunless developers change the way they build and secure these apps.\n </p>\n <div class="blogpost-hr"></div>\n <div class="blogpost-text">\n <p>Thereâs an app for everything, and hackers and thieves are taking advantage. What are enterprises doing about it? Not enough.</p>\n <p>Web and mobile application use has exploded in recent years as businesses have digitized and\xa0moved more of their operations to the cloud, and as the number of mobile devices has\xa0proliferated. Application breaches have increased commensurately, and show no signs of\xa0slowingâunless developers change the way they build and secure these apps.</p>\n <p>Everyone, it seems, has at least one smartphone, but we donât spend much time talking on them.\xa0The <a rel="noopener" href="https://www.statista.com/statistics/330695/number-of-smartphone-users-worldwide/" target="_blank">3+ billion smartphone users</a> worldwide downloaded more than <a rel="noopener" href="https://www.appannie.com/en/insights/market-data/state-of-mobile-2020/" target="_blank">200 billion apps</a> in 2019, and\xa0reportedly spend <a rel="noopener" href="https://www.intertrust.com/blog/the-state-of-mobile-app-security-in-2020/" target="_blank">almost all their phone time</a> using those apps. Android usersâ in-app hours\xa0reportedly grew <a rel="noopener" href="https://www.appannie.com/en/insights/market-data/weekly-time-spent-in-apps-grows-20-year-over-year-as-people-hunker-down-at-home/" target="_blank">20 percent in the first quarter of 2020</a> alone.</p>\n <p>Securing mobile devices against malware, ransomware, and other intrusions has taken top priority with manufacturers, while the applications on those devices get short shrift. But\xa0cybercriminals, it turns out, like to use apps, tooâas a portal for access to our devices, accounts,\xa0and data.</p>\n <p>Particularly hard hit have been mobile and website financial technology, healthcare, and\xa0entertainment apps, including streaming and video games. Akamai recently reported nearly 10\xa0billion incidents of gaming-application âcredential stuffingâ and 152 million attacks on gaming\xa0web applications in 2018-2020.</p>\n <p>
1But the problem isnât limited to one or a few sectors. Across the spectrum, applications are not,\xa0for the most part, secure. Various studies report findings of</p>\n <ul style="list-style-type: disc;">\n <li>Security flaws in <a rel="noopener" href="https://www.intertrust.com/blog/the-state-of-mobile-app-security-in-2020/" target="_blank">83% of all apps</a></li>\n <li>Data leaks in <a rel="noopener" href="https://www.nowsecure.com/resource/infographic-test-of-250-popular-android-mobile-apps-reveal-that-70-leak-sensitive-personal-data/" target="_blank">70% of popular Android applications</a> and <a rel="noopener" href="https://www.nowsecure.com/resource/infographic-test-of-250-popular-android-mobile-apps-reveal-that-70-leak-sensitive-personal-data/" target="_blank">92% of web retail apps</a></li>\n <li>Insecure data storage in <a rel="noopener" href="https://www.ptsecurity.com/ww-en/analytics/mobile-application-security-threats-and-vulnerabilities-2019/" target="_blank">76% of apps</a></li>\n <li>Serious vulnerabilities in <a rel="noopener" href="https://www.intertrust.com/resources/how-secure-are-us-financial-mobile-apps/" target="_blank">71% of the top financial apps</a> and <a rel="noopener" href="https://www.intertrust.com/resources/healthcare-app-security-report-2020/" target="_blank">71% of healthcare apps</a></li>\n </ul>\n <p>Given these grim statistics, the real surprise may be that we havenât seen more application\xa0breaches. We most certainly will, howeverâunless organizations and their developers get\xa0serious about designing security features in-app.</p>\n <p class="blogpost-subheading"><span class="blogpost-text-h1"><strong>The app insecurity complex</strong></span></p>\n <p>Breaches cost moneyâpotentially lots of moneyâand, in some instances, lives. One study\xa0estimates an average data breach cost of <a rel="noopener" href="https://www.ibm.com/security/data-breach" target="_blank">$3.86 million</a>. But what price do we put on the lives\xa0risked when a recent <a rel="noopener" href="https://www.businessinsider.com/uhs-cyberattack-hack-derails-surgeries-at-hospitals-across-us-2020-9" target="_blank">Universal Health Systems</a> breach caused its hospitals to re-route\xa0ambulances and cancel surgeries?</p>\n <p>Rapid digitization seems to be one reason why applications are getting released before theyâre\xa0properly secured. The trend toward âagileâ models in software development, in which apps and\xa0updates get continually released on a 24/7 cycle, is said to favor speed over security.\xa0The shift to cloud technologies plays a role, as well. Securing network perimeters no longer\xa0sufficesâbecause there is no perimeter. Apps reside in the cloud, and they communicate with\xa0one another and with a growing array of sensors and devices via the ever-expanding internet-of-things\xa0(IoT). Unsecure apps means unsecure devices, networks, and systems, as hackers use apps\xa0as a portal for access to the rest.</p>\n <p>There is a solution to the app insecurity complex: in-app protection, or embedding security\xa0features into applications while they are in design.\xa0Gartner estimates that, by 2022, half or more of successful âclickjackingâ and mobile app attacks\xa0will be deemed to have been preventable had encryption and other security features been\xa0incorporated in-app, before deployment.</p>\n <p><span class="blogpost-text-h1"><strong>Most common forms of app attack</strong></span></p>\n <p>The most prevalent app weakness is access control. Data leaks and insecure configuration are\xa0other common vulnerabilities. Cybercriminals know how to exploit these vulnerabilities to</p>\n <ul style="list-style-type: disc;">\n <li>Create fake apps or clones of existing apps via reverse engineering to trick users into providing credentials and other sensitive data as well as access to accounts. This is also known as âtampering.â</li>\n <li>Install bots to launch attacks on websites and perform online betting and other transactions</li>\n <li>
1Install malware on the device or on others in its network. In the infamous WhatsApp malware injection breach, attackers exploited a VOIP (voice over internet protocol) vulnerability in the mobile app that allowed them to inject malware into phones simply by calling them.</li>\n <li>Skim credit-card information</li>\n <li>Inject malicious scripts for clickjacking and formjacking</li>\n <li>Provide access to sensitive stored data â via the deviceâs operating system, the development framework, cookies and preferences, and other avenues for attack</li>\n <li>Eavesdrop on API communications to steal the data in transit â also known as a âman in the middleâ attack</li>\n </ul>\n <p>But there are a number of effective ways to secure applications against intrusion, manipulation,\xa0and theft.</p>\n <p><span class="blogpost-text-h1"><strong>In-app protection techniques</strong></span></p>\n <p>Securing your business and consumer applicationsâand the access to accounts and stored data\xa0they harborâinvolves planning, foresight, and, yes, coding.\xa0When an app will handle very valuable data, or will typically run in insecure environments such\xa0as on consumer devices, in-app protection is your safest bet for securing it.\xa0Developers have many in-app protection techniques from which to choose; some are highly\xa0effective, while others are less so. Typically, theyâre divided into two camps: prevention and\xa0detection. The first type aims to stop breach attempts from succeeding, and those in the second\xa0camp detect and react to intrusions after they have occurred.</p>\n <p>Here are some of the most commonly used in-app protection techniques.</p>\n <p><strong>Prevention</strong></p>\n <p><span style="text-decoration: underline;">a) Code obfuscation:</span> âObfuscateâ means âto hide,â something hackers are already good at as they try to prevent viruses and malware they have installed on systems from being analyzed, by hiding behind a âcurtainâ of junk code. Developers use obfuscation to scramble application code and render it, to the inexperienced eye, unreadable. As a result, static analysis and reverse engineering become much more difficult. Obfuscation techniques include renaming software components and identifiers, inserting useless âdummyâ code as a diversion, breaking up the logical structure of the code, introducing software layers of access indirection, and stripping the appâs low-level functions of certain key components. It is also not uncommon to use encryption to hide parts that provide hints about their functionality (such as strings) too easily.</p>\n <p><span style="text-decoration: underline;">b) Encryption & TLS certificate pinning:</span> Modern encryption algorithms turn code (or text)\xa0into âsecretâ code, or âciphertext,â that no one can read without the matching key. Encryption\xa0can be used to protect data when itâs in storage, in transit, and moving among various networks,\xa0in databases, server files, hard drives, emails, and more.\xa0For data in transit, the most-widely used encryption protocol today is Transport Layer Security\xa0(TLS), which provides confidentiality, integrity, authenticity, and availability services online. In\xa0order to ensure authenticity of the communicating parties, TLS relies on the usage of certificates.\xa0Typically, a certificate presented by a server contains an asymmetric public key, key and\xa0authenticity information on the identity of the server, both signed by a trusted third party.\xa0Other communicating parties could then use the public key to encrypt messages directed to a\xa0particular server. Mathematical properties guarantee that without the possession of a secret\xa0private key matching the public key it is impossible to decrypt protected data in transit.\xa0To eavesdrop on encrypted data flowing between a mobile application and its corresponding\xa0server back end on the internet, hackers issue fake certificates containing a public key where the\xa0private key is known to them. But because information contained in a certificate is signed by a\xa0trusted third party, a fake certificate cannot simply be presented without the mobile app detecting\xa0the attack. With mobile apps, where the goal is to exfiltrate client-server communication and\xa0gain information on the API used by the server\'s backend, hackers found an easier way to get the\xa0signature they need: They add themselves to the list of trusted third parties maintained by their\xa0mobile phone\'s operating system.\xa0âPinning,â or limiting the types of certificates an app will accept, restricts which certificates are\xa0considered valid, and rejects those not on a list carefully curated by a hardened mobile\xa0application.</p>\n <p><strong>Detection</strong></p>\n <p><span style="text-decoration: underline;">a) Dynamic analysis detection:</span> This approach embeds a security system into an application so it can judge whether its current execution environment is controlled by an attacker. Dynamic analysis detection identifies dynamic reverse engineering attempts using debuggers, emulators, binary instrumentation engines (<a rel="noopener" href="https://frida.re/" target="_blank">frida</a>), or hooking (<a rel="noopener" href="http://www.cydiasubstrate.com/" target="_blank">Cydia substrate</a>) engines. These mechanisms detect anomalous environments and breach attempts in real time and can wipe the appâs user data, keys, and other information to deter attacks. They may also terminate the app itself, and alert the administrator to the incident.</p>\n <p><span style="text-decoration: underline;">b) Privilege escalation detection:</span> Typically, mobile phones allow their users to interact with them in limited ways; anything beyond normal apps use is usually out of reach. For example, each app on any modern mobile OS maintains its own view of the file system on the device. Files of other apps are inaccessible without explicit permission from the user. Similarly, the mobile operating system does not allow one app to trace interactions with another one running on the same device. However, the ability to write an application capable of tracing a targeted victim application on the phone might be of value to an attacker who wants to find out about the appâs inner mechanics. Therefore, attackers regularly break into devices in their own possessionâa process usually referred to as âjailbreakingâ or ârooting,â depen
1ding on whether we are in the iOS or Android world. On a rooted device the user (attacker) can modify the mobile operating system to be able to trace the actions of all applications installed on the phone. A jailbroken or rooted device usually indicates that some high-privileged process not approved by the vendor is present, invalidating assumptions about the security model of the operating system (such as, for example, process isolation). Protected applications become aware of systems where privilege escalation attacks had been carried out and can react accordinglyâusually by refusing to operate.</p> </div>\n \n <div class="blogpost-text">\n </div>\n <div class="blogpost-hr"></div>\n <div class="blogpost-back">\n <a href="/about-us/blog" class="btn blog-arrow"><span class="arrow circle-blue icon-arrow-long"></span><div class="back-text">BACK</div></a>\n </div>\n </div>\n </div>\n </section>\n \n \n \n <section class="crosslinking module-common" data-scroll-module="#crosslinking" data-changed-bg-class=--light data-changed-btn-class=--dark-blue >\n <div class="bg d-lg-block" style="background-image: url(/media/hi0fps40/bg-crosslinking-1.jpg)"></div>\n <div class="container">\n <div class="wrapper-heading row">\n \n <div class="sub-headline">\n <p>We are</p>\n </div>\n \n \n <div class="col-lg-6">\n <h2 class="headline"><p>the cryptography<br />and security experts</p></h2>\n </div>\n <div class="col-lg-3">\n <div class="description crosslnk-desc">\n <p>At CYBERCRYPT, we combine decades of experience in cryptography, secure architecture, and security analysis to keep your product protected.</p>\n </div>\n </div>\n <div class="col-lg-3 col-cta">\n <a class="btn btn-cta btn-text-white crosslnk-btn" href="/contact" title="crosslinking button"><p>Get in Touch</p><span class="arrow circle-white icon-arrow-long crosslnk-arrow"></span></a>\n </div>\n \n </div>\n </div>\n </section>\n \n \n </main>\n '}})]})}}},function(e){e.O(0,[812,774,888,179],function(){return e(e.s=1096)}),_N_E=e.O()}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.