Mobile-threat-analysis-short-presentation_owasp.pdf
- 1. The OWASP Foundation http://www.owasp.org Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. Mobile Application Threat Analysis Ari Kesäniemi Nixu
- 3. 3 Thought Process for Discovering Threats 1. “What do we want to protect and why?” 2. “Where could the attack happen?” 3. “What could go wrong?” 4. “Do we have appropriate protection?” 5. “What is the risk we accept?”
- 4. 1. “What do we want to protect and why?” • What are the assets worth protecting? • What would be the business impact if compromised? • Data • Money, privacy, credentials • Transactions and processes • IPR, innovations, algorithms • Reputation, customer experience • Resources 4
- 5. 5 Thought Process for Discovering Threats 1. “What do we want to protect and why?” 2. “Where could the attack happen?” 3. “What could go wrong?” 4. “Do we have appropriate protection?” 5. “What is the risk we accept?”
- 6. 2. “Where could the attack happen?” • What is the attack surface? • Local storage? (Including logs, caches etc) • Connection to back end server? • Connection to third party services? • Malicious user? • Web browsing and content handlers? • Exposed API or RPC? • Third party components part of the application? 6
- 7. 7 Thought Process for Discovering Threats 1. “What do we want to protect and why?” 2. “Where could the attack happen?” 3. “What could go wrong?” 4. “Do we have appropriate protection?” 5. “What is the risk we accept?”
- 8. 3. “What could go wrong?” • What are the most feasible attack scenarios? • How each of the assets (from step 1) could be compromised • Considering confidentiality, integrity, availability and non- repudiation for information assets? • Considering STRIDE* for processes and data flows? • Considering attack surfaces (from step 2)? • Considering the system as a whole? * STRIDE = Spoofing / Tampering / Repudiation / Information disclosure / Denial of service / Elevation of privilege 8
- 9. 9 Thought Process for Discovering Threats 1. “What do we want to protect and why?” 2. “Where could the attack happen?” 3. “What could go wrong?” 4. “Do we have appropriate protection?” 5. “What is the risk we accept?”
- 10. 4. “Do we have appropriate protection?” • Consider each scenario individually • Is there a best practice protection mechanism? Is it implemented in the system? • Build an attack tree when necessary 10 Legend Protection Attack Vector Threat disclosure_of_info stolen_id unauthorized_use eavesdropping forged_authz local_storage_access exploiting_internal_interfaces modification_of_info mitm sync_modification_from_client_to_server malicious_health_tips modified_app stealing_auth_cred exploiting_unencrypted_comm phone_call_fraud modified_phone_nr identity_theft stolen_session_token guessing_or_stealing_password physical_access application_pin server_side_attack attack_from_another_app rooting_device secure_session_storage local_data_encryption api_protection rerouting_comms publish_and_refresh_sync faking_app_in_app_store ssl_protection ip_bound_session social_engineering
- 11. Attack Tree 11
- 12. OWASP Top Ten Mobile Risks (DRAFT) 1. Insecure or unnecessary client-side data storage 2. Lack of data protection in transit 3. Personal data leakage 4. Failure to protect resources with strong authentication 5. Failure to implement least privilege authorization policy 6. Client-side injection 7. Client-side DOS 8. Malicious third-party code 9. Client-side buffer overflow 10.Failure to apply server-side controls 12
- 13. … and: • Abuse of client side paid resources • Failure to properly handle inbound SMS messages • Failure to properly handle outbound SMS messages • Malicious / fake applications from app store • Ability of one application to view data or communicate with other applications • Switching networks during a transaction • Failure to protect sensitive data at rest • Failure to disable insecure platform features in application (caching of keystrokes, screen data) 13
- 14. 14 Thought Process for Discovering Threats 1. “What do we want to protect and why?” 2. “Where could the attack happen?” 3. “What could go wrong?” 4. “Do we have appropriate protection?” 5. “What is the risk we accept?”
- 15. 5. “What is the risk we accept?” • What are the residual risks that can be accepted? • Not every scenario is worth protecting • For scenarios not having good protection, consider DREAD: • Damage • Reproducibility • Exploitability • Affected users • Discoverability • Is there a known threat agent motivated to perform an attack? 15
- 16. Attack Tree 16
- 18. 18 1. “What do we want to protect and why?” 2. “Where could the attack happen?” 3. “What could go wrong?” 4. “Do we have appropriate protection?” 5. “What is the risk we accept?” Threats Threat agents Assets Architecture
- 19. 19 Questions? Resources: • OWASP Mobile Security Project • ENISA: Top Ten Smartphone Risks • Microsoft: STRIDE, DREAD