Mobile Application Security: How to Protect Your Data

Introduction

We can almost guarantee that anyone reading this article has either a mobile device or tablet with an application on it. However, many users don’t realize that every second those mobile phones are not in airplane mode, disconnected from a wireless network, or turned off, they are transmitting data to and from a server or a cloud provider. Permissions on the phone may even allow for data transportation at all hours of the day, tracking us constantly, sending unencrypted data, or storing data on the phone that we have no idea how to access.

Because mobile devices are such an integral part of our lives, we must pay close attention to the data stored on our device or transmitted from our device to a server or cloud provider. Mobile applications are used to make our lives easier or communicate better with other people, we use an application almost every day, but these applications are not without flaws. So, we ask ourselves, how are these mobile applications audited?

Auditing Mobile Applications

Security professionals audit mobile applications using an emulator or personally owned mobile device. We arrange the device to allow us to view its internal workings by either jailbreaking (iOS) or rooting (Android) the device.

Jailbreaking or rooting an iOS or Android device allows us to break free of the manufacturer’s software, which grants us unfettered access to the inner workings of the device. This includes logs, files, and superuser access that would not be allowed for a normal user. Think of it as installing aftermarket parts on a vehicle. We also see how these applications interact with the phone, an external server, or a cloud provider that the application developers use for the transmission and storage of data.

Case Study: Microsoft Teams Vulnerabilities

Consider an app that most companies use on a day-to-day basis, Microsoft Teams. Teams is an instant messaging app for companies and organizations. According to an article by PortSwigger.net, Microsoft Teams had “multiple vulnerabilities” that “could spoof URLs, leak IP addresses.”

This shows that even popular applications installed on a mobile device can have vulnerabilities that may leak personally identifiable information (PII) or share data that should not be shared. Sending that one message to someone or sending a transaction with a banking application may have unknown repercussions. Therefore, mobile application penetration tests must be performed to ensure that security is both adhered to and maintained.

Best Practices for Users to Secure Mobile Applications

We, as users, can perform certain tasks to ensure that our mobile phones and applications are secure:

  1. Periodically audit permissions:

    • Periodically review permissions associated with every application. Ask yourself, does a financial mobile application need permission to check if the battery on your phone is low? Does it need to check your location? This also applies to installing applications from mobile stores.

  2. Use a strong passcode:

    • Ensure that your mobile device uses a strong alphanumeric passcode to prevent unauthorized access.

  3. Avoid public Wi-Fi networks:

    • Do not connect to public wireless networks. Use cellular data if possible, as public Wi-Fi can be easily compromised.

  4. Keep apps and OS up to date:

    • Always update your device to the latest version of the operating system and mobile applications to patch security vulnerabilities.

  5. Check for malicious apps:

    • Verify that the app on the Play Store or Apple Store is not malicious in any way. Reviews can be a telltale sign that an application may have malicious intent.

  6. Don’t store sensitive information:

    • Do not store sensitive information on your mobile device, such as passwords in a note-taking app. These can be viewed if the device is stolen or compromised.

Conclusion

Mobile application security isn’t just for developers, but rather a team effort to ensure that the mobile applications we install on our phones do not lead to compromised sensitive data. These activities help to improve your awareness and reduce exposure as an end user of the applications. However, the security picture is not complete without rigorous, in-depth penetration testing at the application level to ensure that users and their data are protected as you would expect. ���������