Mobile Banking Apps Lack Security: 14 Tested Apps All Had Security Flaws

Those banking-on-the-go apps we’ve come to depend on are now on the hacking hot seat. According to a study by Positive Technologies, of the 14 banking apps tested for security, every one of them had vulnerabilities. Those vulnerabilities can easily be exploited by bad actors, and the study statistics back that up. Overall, 87% of the apps tested can be compromised without a hacker needing physical access to the device. For now, the news about banking app security isn’t good, be they app users (client-side) or the banks (server-side) who promote the apps for customer convenience.

The study used 14 mobile banking apps that had over 500,000 downloads each, testing both Android and iOS devices. Overall, it found Android devices are much more vulnerable to hacking than iOS. The study assigned the vulnerabilities a security grade of low, medium, or high-risk severity. There were no security grades above “medium” for iOS devices, while 29% of their Android counterparts had “high-risk” grades. Those grades, however, do not mean that iOS banking apps are immune from future compromise.

Client side (apps installed on personal devices) make up 46% of the discovered issues. Of those, 76% don’t require a hacker to have physical access to a device to exploit it.

The other component found by Positive Technologies reports that every app, both on client and server-sides, had three security vulnerabilities in common:

• Code is not obfuscated. This leaves apps vulnerable to code analysis by hackers who can then find user names and passwords, obtain credentials, and access web servers.

• Protection against code injection and repackaging is absent. Client-server interaction with no protection against code injection and repackaging is subject to reverse code engineering. Repackaging happens when an application on the market is reverse-engineered, modified, and then redistributed (repackaged) by attackers.

• Code that contains names of classes and methods. It allows hackers to bypass authentication and authorization mechanisms and brute-force user credentials.

Protect Yourself and Your Banking App

• Only use official Google Play or Apple App stores, or the official store for your device, for downloads.

• Always check reviews for an app before installing it. App shortcomings and problems can be found before downloading.

• Never download apps from unofficial, third-party sites (sideloading) as they are generally not scanned for malware as thoroughly as those in the official stores.

• Don’t click links or open attachments in emails from unofficial or unknown sources, or if the link or attachment isn’t expected.

• Always keep device software and all apps updated and patched with security updates.