Mobile App Security in The Midst of a Pandemic

By Tom Tovar CEO and co-creator of Appdome

In the “new normal” of COVID-19, businesses are relying on mobile apps to ensure business operations and revenue flowing.

Restaurants, grocery stores, and essential businesses, for example, now enable customers to order food via their phone for curbside pickup or delivery via apps like GrubHub, DoorDash, and UberEats, increasing safety for consumers.

Businesses face a two-pronged challenge. First is the need to rely on mobile apps to maintain sources of revenue. Second, and equally important, is a massive shift to work-at-home, which has dramatically increased the reliance on mobile apps for internally-focused enterprise processes vital for managing and executing day-to-day workflows.

To cope, organizations are rushing to add new functionality and updates to both their consumer-facing and internal mobile apps, but in so doing, many are making security an afterthought. Indeed, the Verizon Mobile Security Index 2020 found that 43% of organizations knowingly cut corners on mobile security to “get the job done.” And that was before the additional pressure put on development teams by COVID-19.

Organizations that neglect security does so at their peril. Certainly, they may be able to get apps in the hands of end-users faster without adding security protections, but should an attacker compromise their app, the damage to their reputation and their revenue stream could far outweigh any advantage. Brands whose apps have suffered security breaches must often spend millions repairing their brand, fighting lawsuits, and compensating consumers, not to mention the danger they face having their own data stolen or encrypted for ransom. In fact, attackers are already taking advantage of the pandemic and people’s increased reliance on mobility. For example, a recently released Covid-19 tracking app turned out to be ransomware.

One of the big problems, of course, is knowing where to start. It can feel overwhelming. After all, a development group can spend months fixing hundreds of vulnerabilities, while a cybercriminal only needs to find one to mount a successful attack. But while you can’t necessarily anticipate every possible attack, you can address the most serious vulnerabilities, and the Open Web Application Security Project (OWASP) has already identified the most important vulnerabilities found in mobile apps. Protecting against these will significantly increase the security posture for your apps.

Broadly speaking, here are the areas that require the most attention:

Reverse engineering and app tampering protections: Most apps are not protected against attempts to probe them to discover exactly how they work. By tampering, debugging and reverse engineering apps, hackers can not only identify promising vectors for attack, but they can also create malware that closely resembles the real app, which they can then distribute to end-users. Using techniques such as app shielding, developers can prevent hackers from gaining access to the internal operations of their apps. It’s critical to make sure app shielding is properly implemented, however, because if it’s done poorly, hackers can turn off the protections it provides.

App shielding is best implemented alongside code obfuscation, which makes an executable unintelligible so that hackers are unable to read the source code and glean useful information. Together, these two measures can prevent hackers from picking an app apart to recreate it or identify coding vulnerabilities.

Securing data storage: End-users are very concerned about the security of their personally identifiable information (PII) such as passwords, bank accounts and credit card numbers … and they should be. In many apps, this information is stored on the device without any protection at all. As a result, anyone who can get into the phone — a trivial task for a sophisticated hacker in possession of the device — can read or export all the data it stores. For the most part, that’s what thieves are after when they steal a device. They can make much more money off financial fraud and credential theft than they could by simply selling the device on the black market.

Data on the device must be encrypted, both at rest and in use, which means data will be completely unreadable to anyone who does not possess the encryption key to decode it. It’s important to use strong security, as older encryption algorithms may be vulnerable to cracking. The Advanced Encryption Standard using encryption keys that are 256 bits in length — known as AES-256 encryption — is the industry standard.

Secure communication: It’s not that much of an exaggeration to describe a mobile app as a connected bundle of APIs. Mobile apps must communicate via the Internet with other services in order to function, which means communications must be secured. If not, mobile users can fall victim to man-in-the-middle (MitM) attacks, where a hacker intercepts communications between a mobile user and the server they’re trying to reach. A successful MitM attack enables hackers to steal information and even change the data communicated to upload malware onto the end-user’s device.

These attacks are more common than one might think. The Verizon Mobile Security Index 2020 shows that just under 1 in 10 of protected mobile devices detected an MitM attack attempt in 2019.

To secure communications, developers must ensure that the app connects to the back-end server through an encrypted tunnel that uses the secure socket layer (SSL) as well as the transport layer security (TLS) protocols. In addition, developers can also choose to pin a static client certificate to the built app to prevent credential stuffing attacks on the back-end server. Without these protections, end-users’ communications can be easily intercepted and compromised by any hackers.

Of course, implementing these measures requires not only time, but also the right skills, and iOS and Android-specific security skill sets are in high demand. Thankfully, automated, AI-powered platforms now exist that can integrate all of these security measures into a mobile app binary in minutes without any coding at all.

Even before the pandemic, the importance of mobile apps to commerce and day-to-day business was on the rise. During the lockdowns, this trend has accelerated, and it’s unlikely to slow down even once the disease finally recedes. In our new normal, mobile apps have become the primary way for people to do their banking, shopping, order food, transact business and work. It is paramount that, during the COVID-19 pandemic, the mobile apps people use are secure so that the people and businesses are protected.

About the Author

Tom Tovar is the CEO and co-creator of Appdome.