Avoiding the Top Mobile API Security Weaknesses
February 06, 2020

Tom Tovar
Appdome

Every mobile app is built around a set of APIs. In fact, it's not much of an exaggeration to describe APIs as the heart of day's modern mobile. Because of their centrality to the function of mobile apps, securing each API is a difficult task. The burden is placed squarely on mobile app developers, most of whom are not security experts.

In September, OWASP published the OWASP API Security Top 10 Release Candidate, a list of the top ten security weaknesses in application programming interfaces (APIs). Eight of these issues directly relate to mobile app development processes:

Broken Object Level Authorization can create a wide attack surface level access control issue if they expose endpoints that handle object identifiers.

Broken Authentication enables attackers to compromise tokens or exploit implementation flaws to steal users' identities.

Excessive Data Exposure results from relying on the client to filter data, and, unless the client's state is controlled, servers receive too many filters which criminals can abused to access data.

Broken Function Level Authorization can eliminate the separation between user and administrative functions, which attackers can exploit to access administrative functions or other users' resources.

Mass Alignment enables attackers to guess object's properties, read documentation, explore other API endpoints and provide additional object properties in request payloads.

Security Misconfigurations create a wide array of vulnerabilities that attackers can exploit.

Injection is when an attacker sends an interpreter untrusted data to trick it into executing commands or accessing data.

Improper Assets Management can result in exposing more endpoints than is safe, such as debug endpoints.

The good news is that there are a number of security capabilities that Devops teams can implement to protect against these vulnerabilities and secure their apps with a layered defense model that protects against all vectors of attack. A comprehensive layered defense model has the following components:

Data Encryption

Data Encryption defense layer encrypts all of the app and API data using industry standard AES-256 encryption or government sanctioned FIPS 140-2 cryptography. In addition, best practice data encryption also secures all strings and resources in the app so that all personally identifiable information (PII), server URLs, API keys, API secrets and other sensitive are protected against credential theft.

Code Obfuscation

A comprehensive code obfuscation defense layer protects the structure, control flow and logic of the app and the APIs in the app. It does so by encrypting the binary code of the app as well as all native and non-native libraries, and making sure that any code, API URLs and static data are not accessible.

App and API Shielding

Shielding the app and its APIs hardens the mobile app and mobile APIs with anti-tampering, anti-debugging and anti-reversing protection. This will protect against fraud unauthorized distribution, API hooking and dynamic analysis.

Secure Communication

Secure communication creates trusted sessions that protect and encrypt all communications between the app, the APIs and the back-end server. This ensures the validity of all end points and any intermediate systems in between the app, the APIs and their back-end servers.

API Segmentation

Best-in-class API segmentation provides the last layer of defense to ensure that all mobile APIs are secure. By using strong authentication, API tokenization, segmented API workflows (for key and cookie stores), developers can ensure that only the right users can access specific API resources.

APIs are the heart of mobile app functionality, so it's critical to ensure that they are secure using multiple layers of security protection. By implementing measures listed above, mobile developers can prevent cybercriminals from taking advantage of the most common vulnerabilities.


Table: The OWASP API Top 10 and security measures to mitigate them

Tom Tovar is CEO of Appdome
Share this

Industry News

October 06, 2022

Platform.sh announced it has partnered with MongoDB.

October 06, 2022

Veracode announced the enhancement of its Continuous Software Security Platform to include container security.

This early access program for Veracode Container Security is now underway for existing customers.

The new Veracode Container Security offering, designed to meet the needs of cloud-native software engineering teams, addresses vulnerability scanning, secure configuration, and secrets management requirements for container images.

October 06, 2022

Mirantis announced that Mirantis Container Runtime – latest generation of the Docker Enterprise Engine, the secure container runtime that forms the foundation of Mirantis Container Cloud and Mirantis Kubernetes Engine and is used at the heart of many other Kubernetes deployments – is now available in the Microsoft Azure Marketplace.

October 05, 2022

Perforce Software announced enhanced support for automated testing with the release of Helix ALM 2022.2.

October 05, 2022

Parasoft announced the latest releases of its API and microservices testing tools, including SOAtest, Virtualize, CTP, and Selenic.

October 05, 2022

Vaadin announced the release of four Acceleration Kits designed to make it faster and easier to build and modernize Java applications for enterprise use.

October 04, 2022

Pegasystems announced the latest release of Robot Studio, the robotic process automation (RPA) low-code authoring environment for Pega's intelligent automation platform.

October 04, 2022

EvolveWare announced the Agile Business Rules Extraction (Agile BRE) solution on its Intellisys platform.

October 04, 2022

Mabl announced new features that empower quality professionals to easily validate APIs as part of their integrated end-to-end tests.

October 03, 2022

Spectro Cloud announced a major new release of its Palette Edge platform.

October 03, 2022

Arcion announced agentless change data capture (CDC) for all of its supported databases and applications.

September 29, 2022

CloudBees announced the acquisition of ReleaseIQ to expand the company’s DevSecOps capabilities, empowering customers with a low-code, end-to-end release orchestration and visibility solution.

September 29, 2022

SmartBear continues expanding its commitment to the Atlassian Marketplace, adding Bugsnag for Jira and SwaggerHub Integration for Confluence.

Bugsnag developers monitoring application stability and documenting in Jira no longer need to interrupt their workflow to access the app. Developers working in SwaggerHub can use the macro to push API definitions and changes directly to other teams and business stakeholders that work within Confluence. By increasing the presence of SmartBear tools on the Atlassian Marketplace, the company continues meeting developers where they are.

September 29, 2022

Ox Security exited stealth today with $34M in funding led by Evolution Equity Partners, Team8, and M12, Microsoft's venture fund, with participation from Rain Capital.

September 29, 2022

cnvrg.io announced that the new Intel Developer Cloud is now available via the cnvrg.io Metacloud platform, providing a fully integrated software and hardware solution.