Weak Security In Most Mobile Banking Apps

Eight of 10 iOS, Android mobile banking apps are improperly configured, new report says

Most mobile banking apps -- including those of major financial institutions -- contain configuration and design weaknesses that leave them with weakened security.
Security experts this month tested 275 Apple iOS- and Android-based mobile banking apps from 50 major financial institutions, 50 large regional banks, and 50 large U.S. credit unions. Overall, they found that eight out of 10 apps were improperly configured and not built using best practices software development. Among the big-name banks whose mobile apps were tested by security firm Praetorian include Bank of America, Citigroup, Wells Fargo, Goldman Sachs, Morgan Stanley, Capital One Financial, and Suntrust Banks. Praetorian did not disclose how each banks apps fared in the tests.
Praetorians research comes at a time when mobile banking is starting to take off, albeit slowly. Some 35 percent of U.S. adults conduct mobile banking, up from 24 percent in 2012, according to the Pew Research Center. A new report by NSS Labs says some banks report seeing mobile banking grow by up to 70 percent per year.
Nathan Sportsman, founder and CEO of Praetorian, says the security weaknesses in the mobile banking apps he and his team tested are not pure software vulnerabilities, so they are relatively low-risk issues that could ultimately lead to exploitation.
These arent business-logic or application-specific issues. They are weaknesses across the mobile apps -- things developers should be doing but they are not, Sportsman says. The apps were downloadable from the Apple App Store and Google Marketplace.
The weaknesses the researchers tested for are well-known mitigation functions in software, and the tests were performed on each local devices mobile app, not back-end Web servers and services. Sportsman says the test only represents a snapshot of the full attack surface of mobile banking because between 75 to 90 percent of mobile banking occurs on the back end.
This was not intrusive testing. We werent looking for SQL injection and would need permission to do that, so we were really looking at the configuration of the mobile apps, he says. His firm hopes to next test these apps for how information gets stored on the local device, he says.
The test was conducted using Praetorian’s Project Neptune, its new mobile application security testing platform. Among the findings in the first test: Many of the iOS-based mobile banking apps did not have enabled Automatic Reference Counting (ARC), a memory management feature; Position Independent Executable, which prevents buffer overflows; and stack protection, which protects apps from stack smashing.
Stack smashing and ASLR [address space layout randomization] have been around a long time, and these [protections] should be enabled in the apps, Sportsman says.
And many of the Android-based mobile banking apps were discovered to be targeting older versions of the Android software development kits, lacking permission hardening, and with the debugging function enabled.
Permissions for me as a consumer are most important: What permissions is the app requesting, and do they really need them? Many overuse the permissions with more than they need, he says.
For developers, the older SDK-targeting and debugging features would be the biggest concerns, he says.
Large financial institutions, not surprisingly, faired better than credit unions or regional banks, but not dramatically: Credit unions had 108 configuration weaknesses in their apps; regional banks, 97; and large financial institutions, 75.
Why the configuration issues in these apps? Overall, theres a rush-to-market pressure for mobile banking in the technology-forward financial services industry, which can lead to some mistakes along the way, he says. But we found that regional banks and credit unions tend to manifest this more than the megabanks ... and a lot of them tend to outsource the development, and its more a one-and-done, he says. But megabanks do theirs in-house, so theres more [ongoing] maintenance with the apps, he says.
NSS Labs Ken Baylor, meanwhile, notes that many mobile banking apps are still mostly rudimentary security-wise. Most banks began offering mobile services with a simple redirect to a mobile site (with limited functionality) upon detection of the smartphone HTTP headers, he wrote
in a new report on mobile financial malware
. Others created mobile apps with HTML wrappers for a better user experience and more functionality. As yet, only a few have built secure native apps for each platform.
Many mobile banking apps are based on simplified HTML code, making them vulnerable to exploits -- this should prompt more banks to develop secure native apps for mobiles, incorporating fraud-resistant features like hardened in-app browsers, encryption and geolocation, Baylor said in the report.
Meanwhile, Praetorian is releasing a free tool that tests for these weaknesses in mobile apps, Sportsman says.
The full report on the mobile banking apps test is available
here
for download.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Weak Security In Most Mobile Banking Apps