Application Security & Tips
Hey Guys, Today we are going to discuss application security. Present time, is the most common fear for all the users/clients. Is their application data secure?
In this article, we are going to discuss the pointers for both iOS and Android Applications.
Save Data on a secure place
Most of the applications are using the wrong data storage to save their private data. In iOS approximate 80% of applications are using the User default to save their data inside the app.
Generally, the developer used user default for saving the user data like email, Phone number, UserID/Accesstoken, Crypto keys, etc. So, guys, you are making the biggest mistake when you are choosing user default to save user private data because using a third party mac application without even having to Jailbreak your device, you can easily view UserDefaults data for any app downloaded from the AppStore. you can increase your iOS security by this link.
For the Android same I will recommend using Internal storage on the place of shared preferences. Because you know that the Android phone is less secure than iOS.
Prevent Man in the Middle Attack
What is Man in the Middle attack? It also is known as a hijack attack is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other. Please check the below image it’s describing the Man in the Middle attack
So if the man in the middle attack happens to the connection then user privacy can compromise eg. user passwords, important documents, important messages, etc.
So the solution of the Man in Middle attack is SSL pinning. SSL stands for the Secure socket layer and it makes sure that the client is communicating to the right server and the server is communicating to the right client. Below are the tasks for which SSL is responsible.
How will keys be exchange
How will data be encrypted
How will messages be marked as authentic?
SSL certificate contains a key pair that has Public and private keys. These keys work together to establish an encrypted connection. The certificate also contains the “Subject” which is the identity of Certificate/Website owner.
Take care of Secret Keys when pushing the code to the repository
Guys This can be possible that it is not a permanent solution but I have written this point according to my observation.
Get Amit Singh’s stories in your inbox
Join Medium for free to get updates from this writer.
When we talk about storing the secret keys on Git so, many developers can say that they’re storing API keys on their private Git repositories. You are aware of the public repo that is not secure at all, anyone can download the code and run at their system. But there is some risk on the private repo as well.
Private Git repositories hosted on services such as GitHub, GitLab, and Bitbucket are exposed to a different type of risk. When you integrate a third-party application with one of the services mentioned, you may be opening your private repositories to those third parties. Those applications will be able to access your private repositories and read the information contained within. So the attacker can find your sensitive data from it.
Let’s talk about the solutions
You can obfuscate the secret keys
you can use BlackBox is a tool created by the Stack overflow community is the best tool to encrypt small strings. BlackBox is a robust tool as it works with Git as well.
There are multiple tools on Git as well like Git secret and Git-crypt
Beware of the Third-Party Integration
Present time if we face any problem related to the project we generally check on the internet if any third party available to expedite the task. Adding a third party is not the wrong thing. But please make sure that the third party is not taking your personal data and it is 100% secure. Don’t ever disable ATS for them, even if they ask politely.
Prevent Jailbreaking
As you know, the attackers can easily jailbreak any application by installing free software on their laptops by downloading the app from Appstore or Playstore.
For preventing Jailbreak in the application we need to check if the device is jailbroken or not if the device is jailbroken then we can not allow our application to install on that device. It can impact on application userbase.
There will be multiple advantages of detecting devices on Jailbroken. hackers will not able to access your sensitive data from within your application. If you really want an extra layer of security then I would suggest you implement it on your app. Or if you are developing an application for your client you should ask him before implementing it.
Session Handling
The application server sends back the session token on successful authentication with the mobile application. These session tokens are used by the mobile applications to request for services. If these session tokens remain active for a longer duration and adversaries obtain them via malware or theft, the user account can be hijacked. So presently you can check if you are not using the application long time then it will automatically log out and you have to log in again. Multiple applications automatically logged out even you are an active user.
Binary Protections
Mobile application source code is available to everyone. An attacker can reverse engineer the application and insert venomous code components and recompile them. If these applications are installed by a user, their data can be theft, become victims of unintended actions, and so on. Most of the applications do not ship with mechanisms such as checksum controls, which help in deducing whether the application has tampered or not. we should have to take care of some pointers at the time of writing the code so that we can prevent our code of reverse Engineering and code tampering. We can also use Proguard for Android Application
Conclusion
We need to take care of the above pointers to ensure that our application has a security layer.
There can be more pointers that can increase more security of the applications for that you can read OWASP mobile top 10 risks.
Bye-Bye! Eat, Sleep, and Work.
