hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015While smartphones can be used for viewing, manipulating, and storing local data, these devicesalso free users to interact with a world of interconnected resources from the convenienceof their hands. Through communication protocols, both sensitive and benign data is sharedbetween remote services and our devices. The third most common aggregate vulnerabilitycategory is Insecure Transport (66.14 percent), which identifies weaknesses caused by the useof communication protocols that do not protect sensitive data through encryption (such asHTTP instead of HTTPS) or that make use of less secure protocol options.Taking the fourth spot, Insecure Deployment weaknesses were identified in 61.64 percentof the mobile applications studied. Insecure Deployment combines various deploymentconfigurations, settings, and states that result in unnecessary weaknesses. For mobile appsthis may include not using features such as PlayReady DRM, not checking to determine if theapp is running on a jailbroken device, or exhibiting properties that may indicate malicious intent.Rounding out our top five, Poor Logging Practice weaknesses were found in 46.56 percent ofthe mobile applications. The use of standard output often indicates that the application is usingstandard output for debugging and logging rather than structured logging facilities such asandroid.util.Log for Android, or the use of NSLog in iOS. Because standard outputs, and logs,can be read by third parties, developers should always be cognizant of the risks associated withany sensitive information being written.Top 10 mobile application vulnerabilitiesAs shown for Web applications, each category within the taxonomy can be further refined intomore specific vulnerabilities. The following chart depicts the vulnerabilities observed with thehighest frequency in the sample population of mobile applications.Figure 24. The 10 most common vulnerabilities noted in mobile apps in 2014Insecure storage: Insufficient data protection 54%Poor logging practice: Use of a system output stream47%Weak cryptographic hash43%Insecure deployment: Missing jailbreak detection37%Insecure deployment: Known mobile attack surface fingerprintWeb server misconfiguration: Information disclosureInsecure transportPrivacy violation: GeolocationNull dereference34%33%32%31%30%Insecure transport: Defeatable certificate pinning29%0% 10% 20% 30% 40% 50% 60%56