Mobile Data Security

5 automated security scanners

Offline Data Protection

Purpose: The Offline Data Protection Scanner is designed to ensure that mobile applications maintain robust data-at-rest encryption, secure offline storage mechanisms, and effective sync security to protect sensitive information from unauthorized access. This tool evaluates the overall security posture of an application by examining its use of strong encryption algorithms for local data storage, secure storage APIs, secure sync protocols, API security measures, and DNS, HTTP, and TLS configurations.

What It Detects:

Data-at-Rest Encryption: Checks for the presence of strong encryption algorithms in app storage to protect sensitive information from unauthorized access. The scanner identifies weak or deprecated encryption methods used in storing data locally on devices.
Secure Offline Storage: Evaluates the use of secure storage APIs and libraries within the application, detecting potential vulnerabilities such as plaintext storage or improper key management.
Sync Security: Analyzes the security measures implemented during data synchronization processes to ensure that sensitive data is transferred securely between devices or servers. The scanner identifies insecure sync protocols or lack of encryption during data transfer.
API Security: Inspects APIs used by the application for any vulnerabilities that could expose sensitive data, checking for secure authentication and authorization mechanisms in place for API access.
DNS, HTTP, and TLS Configuration: Validates DNS configurations to ensure they do not expose sensitive information or misconfigure security settings, examines HTTP headers for security best practices such as HSTS, CSP, XFO, and XCTO, and inspects TLS/SSL certificates and cipher suites to ensure strong encryption protocols are in use.

Inputs Required:

domain (string): Primary domain associated with the application (e.g., acme.com). This is necessary for DNS queries, HTTP requests, and TLS/SSL inspection to assess the security configuration of the application’s online presence.
app_identifier (string): Unique identifier for the mobile application (e.g., com.acme.app). While not directly related to the technical aspects evaluated by this scanner, it could be used in conjunction with domain information to provide a more comprehensive security assessment of the overall ecosystem.

Business Impact: Ensuring robust data protection is crucial for maintaining trust and compliance with regulatory standards such as GDPR or HIPAA. Poor encryption practices can lead to unauthorized access to sensitive information, which may result in significant financial losses, legal penalties, and damage to reputation.

Risk Levels:

Critical: Conditions that would be considered critical include the discovery of applications using deprecated or weak encryption algorithms for data storage, insecure sync protocols leading to potential data leakage, and misconfigured DNS settings exposing sensitive information.
High: Conditions at high risk include the use of plaintext storage methods for sensitive data, lack of secure authentication mechanisms in APIs, and TLS configurations that do not meet modern security standards.
Medium: Medium severity risks involve less critical vulnerabilities such as missing or improperly configured HTTP headers, outdated TLS versions, or inadequate offline storage security measures.
Low: Informational findings at low risk are typically related to minor misconfigurations or non-critical issues in DNS settings and API usage that do not pose significant security threats.

Example Findings:

The application uses AES-128 for data encryption but does not support the more secure AES-256, which could be considered a critical issue due to its increased cryptographic strength.
Sensitive data is stored in plaintext within local databases, posing a high risk of unauthorized access if the database is compromised.

Biometric Implementation Security

Purpose: The Biometric Implementation Security Scanner is designed to identify potential vulnerabilities and weaknesses in mobile applications related to biometric authentication. It aims to detect bypasses of biometric mechanisms, downgrade attacks on secure authentication methods, and signs of replay attacks to ensure the robust security of biometric data within these applications.

What It Detects:

Biometric Bypass Vulnerabilities: The scanner identifies patterns that suggest potential attempts to bypass or circumvent biometric authentication in mobile apps. This includes keywords such as “bypass.*biometric”, “skip.*authentication”, and “disable.*fingerprint”.
Authentication Downgrade Attacks: It detects efforts to downgrade secure authentication methods to less secure alternatives, with indicators like “downgrade.*auth”, “fallback.*to.*basic”, and “reduce.*security”.
Replay Attack Indicators: The scanner looks for signs that replay attacks might be possible or have occurred through keywords such as “replay.*attack”, “duplicate.*requests”, and “session.*reuse”.
Security Headers Analysis: It checks HTTP responses for critical security headers to ensure they are properly configured, including “strict-transport-security”, “content-security-policy”, “x-frame-options”, and “x-content-type-options”.
TLS/SSL Configuration Issues: The scanner inspects SSL/TLS configurations for known vulnerabilities and deprecated protocols or ciphers, such as “TLSv1.0”, “TLSv1.1”, “RC4”, “DES”, and “MD5”.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
app_identifier (string): Unique identifier for the mobile application (e.g., com.acme.app)

Business Impact: Robust security of biometric data is crucial for maintaining trust and compliance with privacy regulations. This scanner helps in identifying potential vulnerabilities that could lead to unauthorized access or data breaches, thereby enhancing the overall security posture of mobile applications handling sensitive biometric information.

Risk Levels:

Critical: Conditions where biometric bypasses are detected without proper authentication, leading to unauthorized access.
High: Conditions where secure authentication methods are downgraded unnecessarily, potentially reducing the level of protection for user data.
Medium: Conditions where there is a possibility of replay attacks due to lack of session management or improper request handling.
Low: Conditions related to missing or improperly configured security headers that do not significantly impact overall application security but should be addressed for best practices.
Info: Informational findings regarding deprecated protocols and ciphers used in the TLS/SSL configuration, which may require updates for compliance with modern security standards.

Example Findings:

A mobile app using biometric authentication fails to detect attempts to bypass fingerprint scanning through API calls containing phrases like “bypass.*biometric”.
An application allows downgrade from secure OAuth 2.0 to basic HTTP authentication, as indicated by patterns such as “fallback.*to.*basic” in configuration files or comments.

Mobile DRM Implementation

Purpose: The Mobile DRM Implementation Scanner is designed to identify vulnerabilities in mobile applications related to Digital Rights Management (DRM) implementations. It aims to detect potential issues such as bypasses of content protection, flaws in license validation, and media security weaknesses. This scanner ensures that the application adheres to strict security standards, protecting against unauthorized access to protected content.

What It Detects:

Content Protection Bypass: Identifies patterns indicating potential bypasses of DRM mechanisms, checking for suspicious code or configurations that could allow unauthorized access to protected content.
License Validation Flaws: Scans for weak or missing license validation checks and improper handling of license keys or tokens.
Media Security Vulnerabilities: Analyzes media files and streams for security weaknesses in the delivery and playback of protected content.
Security Headers Analysis: Examines HTTP responses for critical security headers to ensure protection against common web vulnerabilities.
TLS/SSL Inspection: Inspects SSL/TLS configurations for outdated protocols, weak cipher suites, and potential man-in-the-middle attacks.

Inputs Required:

domain (string): The domain of the mobile application’s server (e.g., acme.com). This is crucial for DNS queries, HTTP requests, and TLS/SSL inspection to assess security configurations.
app_identifier (string): The unique identifier for the mobile application (e.g., com.acme.app). This helps in identifying specific applications during scanning.

Business Impact: Ensuring robust DRM implementations is critical for maintaining the integrity and security of digital content. Flaws in DRM can lead to unauthorized access, data breaches, and legal repercussions. The scanner’s findings are essential for improving application security posture and user trust.

Risk Levels:

Critical: Conditions that directly compromise the security of the mobile application, such as complete bypass of DRM mechanisms or exposure of sensitive content without authorization.
High: Vulnerabilities that can lead to significant risks if exploited, including weak license validation or media stream vulnerabilities.
Medium: Issues that may be exploitable but with more stringent conditions or require additional steps for exploitation, affecting the overall security balance.
Low: Informal findings that do not significantly impact application security but are still important to address for continuous improvement.
Info: General information about configurations and headers present in typical web responses.

Example Findings:

The scanner might flag a critical issue where an app allows unauthorized access to DRM-protected content, leading to a Critical risk. Another example could be the detection of weak cipher suites used for TLS/SSL connections, which would be flagged as a High risk if not addressed.

Local Storage Security

Purpose: The Local Storage Security Scanner is designed to identify and report insecure data storage practices within mobile applications. It aims to detect vulnerabilities such as plaintext storage of sensitive information, unencrypted databases, cache exposure without proper encryption, and the absence of critical security headers in HTTP responses. This tool ensures that sensitive data remains protected from unauthorized access by identifying potential risks associated with inadequate security measures.

What It Detects:

Insecure Data Storage: Identifies instances where passwords or other sensitive information are stored in plain text or using weak encryption methods, as indicated by patterns such as password\s*=\s*"[\w]+".
Unencrypted Databases: Detects unencrypted database files that could be accessed if the application’s storage is compromised, identified by patterns like CREATE TABLE [\w]+\s*\(([^)]+)\);.
Cache Exposure: Identifies cached data containing sensitive information and checks for proper encryption or protection mechanisms, as seen in headers such as Cache-Control: no-cache or Cache-Control: max-age=0.
Security Headers Absence: Checks the absence of critical security headers in HTTP responses to ensure secure communication channels. This includes checking for presence of headers like strict-transport-security, content-security-policy, x-frame-options, and x-content-type-options.
TLS/SSL Vulnerabilities: Inspects SSL/TLS configurations for outdated protocols (e.g., TLSv1.0, TLSv1.1) and weak cipher suites (including RC4, DES, MD5).

Inputs Required:

domain (string): The primary domain to analyze, such as acme.com.
app_identifier (string): A unique identifier for the mobile application, like com.acme.app.

Business Impact: Ensuring that sensitive data is protected from unauthorized access is crucial for maintaining a secure and compliant digital environment. Inadequate protection of local storage can lead to significant security breaches, potentially compromising user credentials and other critical information. This not only affects the integrity of the application but also its compliance with regulatory standards such as GDPR or HIPAA.

Risk Levels:

Critical: Vulnerabilities that directly compromise data confidentiality and integrity, such as unencrypted databases or insecure data storage practices where sensitive information is stored in plain text.
High: Issues that significantly increase the risk of unauthorized access to sensitive data through cache exposure without proper encryption or headers missing critical security protections.
Medium: Vulnerabilities that pose a moderate risk if not addressed, such as presence of outdated SSL/TLS protocols or weak cipher suites.
Low: Informational findings indicating potential improvements in security practices, which are less likely to be exploited but still contribute to enhancing the overall security posture.
Info: Non-critical issues providing basic security hygiene information that aids in improving application security without immediate risk.

Example Findings:

Insecure data storage was detected in /data/data/com.example.app/files/credentials.txt where a password pattern password="mypassword123" was identified.
An unencrypted database file /data/data/com.example.app/databases/user_data.db was found to contain sensitive information in clear text, violating security best practices.

Clipboard Security

Purpose: The Clipboard Security Scanner is designed to safeguard sensitive information by detecting and preventing unauthorized exposure through various means. It identifies potential threats such as sensitive data in clipboard, safeguards against screenshot captures, enforces restrictions on copying sensitive data, evaluates domain-specific security headers for web applications, and assesses the TLS/SSL configuration for network communications.

What It Detects:

Sensitive Data Detection in Clipboard: Identifies patterns indicative of credit card numbers, social security numbers, and personal identification details using regex patterns to match common formats of sensitive data.
Screenshot Protection: Monitors clipboard activities to prevent unauthorized capture of sensitive screens, detecting attempts to take screenshots using system events or APIs.
Copy Protection: Enforces restrictions on copying sensitive information from designated secure areas, blocking copy operations that attempt to transfer sensitive data.
Domain-Specific Security Headers Analysis: Checks for the presence and correctness of security headers like Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options to ensure compliance with best practices for web security.
TLS/SSL Configuration Evaluation: Inspects SSL/TLS configurations to identify potential vulnerabilities, detecting outdated protocols (e.g., TLSv1.0, TLSv1.1) and weak cipher suites (e.g., RC4, DES, MD5).

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
app_identifier (string): Unique identifier for the application (e.g., “com.acme.app”)

Business Impact: This scanner is crucial for organizations aiming to maintain a secure and compliant digital environment, preventing unauthorized access to sensitive information through various vectors such as clipboard operations, screenshots, and network communications.

Risk Levels:

Critical: Conditions that directly lead to significant security breaches or data exposure are considered critical. For example, the absence of Strict-Transport-Security header can be a critical issue if it compromises encryption for user credentials.
High: High-risk scenarios include unprotected clipboard operations and use of outdated TLS protocols which can significantly weaken network security.
Medium: Medium risk findings involve configurations that might require immediate attention but do not pose an immediate threat to data security, such as the presence of weak cipher suites in SSL/TLS configuration.
Low: Informational findings are typically suggestions for improvement without significant impact on security posture, like minor misconfigurations in content security policies.
Info: These include general recommendations and informational messages about potential improvements or best practices that do not currently affect security but could be beneficial to implement.

Example Findings:

A clipboard operation detected containing a credit card number pattern indicative of sensitive data.
Screenshot protection failed to detect an unauthorized screenshot attempt from a secure application area.
The domain “example.com” was found to use TLSv1.0, which is considered outdated and insecure for modern network communications.