{"id":1932,"date":"2020-12-21T18:23:38","date_gmt":"2020-12-21T18:23:38","guid":{"rendered":"https:\/\/sectigostore.com\/blog\/?p=1932"},"modified":"2020-12-21T18:27:53","modified_gmt":"2020-12-21T18:27:53","slug":"owasp-mobile-top-10","status":"publish","type":"post","link":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/","title":{"rendered":"OWASP Mobile Top 10 Vulnerabilities &#038; Mitigation Strategies"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><strong>According to <a href=\"https:\/\/www.statista.com\/statistics\/330695\/number-of-smartphone-users-worldwide\/\">Statista<\/a> there are 3.5 billion smartphone users <strong>\u2014<\/strong> that means a lot of people who could become victims of insecure mobile apps<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The OWASP Mobile Top 10 list is a great resource for app developers who want to create secure apps. That&#8217;s because many mobile apps are inherently vulnerable to security risks. Let\u2019s think about some of the attacks on mobile apps that have occurred in the past few years. There was the WhatsApp <a href=\"https:\/\/indianexpress.com\/article\/explained\/whatsapp-spyware-pegasus-india-surveillance-nso-israel-6096910\/\">Pegasus<\/a> spyware that enabled attackers to control victims\u2019 devices. Another was also the attack on the <a href=\"https:\/\/nordicapis.com\/how-pokemon-go-fans-hacked-em-all-and-how-to-prevent-similar-reverse-engineering\/\">Pok\u00e9mon Go<\/a> app, where users could reverse-engineer the app to catch more Pok\u00e9mon.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Many other apps and organizations, such as <a href=\"https:\/\/www.wired.com\/story\/tinder-lack-of-encryption-lets-strangers-spy-on-swipes\/\">Tinder<\/a> and <a href=\"https:\/\/threatpost.com\/mediatek-bug-actively-exploited-android\/153408\/\">MediaTek<\/a>, have fallen victim to mobile security attacks. But what makes them so vulnerable? Mobile apps have a greater attack surface than web apps since the apps can be downloaded from public stores, and the code can be inspected. Combine that with that the amount of user data they can collect, and we\u2019re left with very attractive targets for cybercriminals. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/owasp.org\/www-project-mobile-top-10\/\">OWASP mobile top 10 vulnerabilities list<\/a> the most common security flaws found on mobile devices. But what is included on the OWASP mobile security list of vulnerabilities?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>OWASP Mobile Top 10 Vulnerabilities<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Based upon survey and feedback collected from the worldwide community, the Open Web Application Security Project foundation gave us the OWASP mobile security risks for the first time in 2011. After that, they released new lists in 2014 and 2016 \u2014 the latter being the latest and most current OWASP mobile top 10 list.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While there\u2019s one exact carry-over from the <a href=\"https:\/\/owasp.org\/www-project-mobile-top-10\/2014-risks\/\">2014 top 10 mobile risks list<\/a>, the <a href=\"https:\/\/owasp.org\/www-project-mobile-top-10\/2016-risks\/\">2016 top 10 mobile risks list<\/a> is mainly different in terms of the categories break down. For example, in the 2016 list, one of the items from the 2014 list was removed and two new risks were added. They also split some categories in half to address them separately.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1003\" height=\"705\" src=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-changes-2014-2016.png\" alt=\"A side-by-side comparison chart of the OWASP Mobile Top 10 lists from 2014 and 2016\" class=\"wp-image-1934 addshadow\" srcset=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-changes-2014-2016.png 1003w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-changes-2014-2016-300x211.png 300w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-changes-2014-2016-560x394.png 560w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-changes-2014-2016-940x661.png 940w\" sizes=\"auto, (max-width: 1003px) 100vw, 1003px\" \/><figcaption>A side-by-side comparison of OWASP 2014 and 2016 mobile risks.<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">With this in mind, let\u2019s explore the 10 mobile risks that made the final cut in 2016 and look at the ways you can remediate these risks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M1. Improper Platform Usage<\/strong><\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-illustration.png\" alt=\"An OWASP mobile top 10 graphic that looks like a mobile phone number keypad that contains the vulnerability initials with each corresponding vulnerability number\" class=\"wp-image-1935\" width=\"266\" height=\"353\" srcset=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-illustration.png 598w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-illustration-226x300.png 226w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-illustration-560x744.png 560w\" sizes=\"auto, (max-width: 266px) 100vw, 266px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The latest <a>OWASP mobile top 10 list<\/a> ranks improper platform usage as the leading mobile security vulnerability. Whether you\u2019re an Android user or an iOS customer, each of these platforms are expected to adhere to certain developmental guidelines for security purposes. However, apps may unintentionally violate these published guidelines, best practices, or goof up in their implementation process. That is what this first mobile security risk talks about.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This threat refers to the misuse of any platform feature of the Android or iOS operating system or failure to incorporate platform security controls. This includes issues concerning improper use of security controls and platform features that are a part of the mobile operating system, such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Misuse of the iOS Touch ID feature, which can result in unauthorized access to the device.<\/li><li>Incorrect use of the iOS Keychain for instance by storing session keys in the app local storage,<\/li><li>Requesting excessive or wrong platform permissions,<\/li><li>Android intents (used to request an action from another app component) that are marked public may reveal sensitive information or permit unauthorized execution.<\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This OWASP mobile security risk is something that you must address on the server side of things. Alongside following platform development guidelines, using secure coding practices and applying the right configuration settings on the server-side helps to minimize risks. Additional mitigation strategies to reduce platforms from being used improperly include the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Restricting apps from communicating with each other, limit access, implement restrictive file permissions, etc.<\/li><li>Applying the most restrictive protection class for iOS keychains and adopt best practices to avoid weak implementation of any controls.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M2. Insecure Data Storage<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Next on the OWASP mobile top 10 list is insecure data storage. Your mobile device may get lost or stolen and land in the hands of an adversary. Or a piece of malware, acting on the attacker\u2019s behalf, may execute on the device, and the attacker might be able to exploit vulnerabilities that leak personal information and gain access to sensitive data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While it isn\u2019t always feasible to have apps that don\u2019t store data, it is crucial to store that data securely in a place that won\u2019t be accessible to another app or an individual. <a href=\"https:\/\/sectigostore.com\/blog\/what-is-jailbreaking-an-iphone-is-jailbreaking-safe\/\">Jailbreaking<\/a> or rooting a mobile device is sufficient to dodge encryption protection, and dev teams must never assume that attackers won\u2019t have access to filesystems if they\u2019re easily accessible. &nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Threat model the app to understand what information assets are processed by the application and how the APIs handle the data. Doing this helps you to:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Assess whether encryption is applied effectively and how the encryption keys are protected.<\/li><li>Implement technologies to harden the code against tampering by using obfuscation, protection against buffer overflows and so on,<\/li><li>Avoid storing\/caching data where feasible, and<\/li><li>Deploy sound <a href=\"https:\/\/sectigostore.com\/blog\/the-difference-between-authentication-and-authorization-explained-in-detail-by-a-security-expert\/\">authentication and authorization<\/a> checks.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M3. Insecure Communication<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Insecure communication ranks third in 2016 OWASP mobile top 10 list. If the data travels unencrypted in cleartext, anyone monitoring the network can capture and read all the information being sent over the wire.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mobile apps commonly exchange data in a client-server model, and it must be transmitted over the device\u2019s carrier network and the internet securely. The traffic can be intercepted by proxies, cell towers, or an adversary compromises your Wi-Fi or installs malware on your device. So, what can you do it mitigate vulnerabilities associated with these types of data exchanges?<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">To avoid data from being stolen as it travels across the network, rely on industry-standard encryption protocols and other general best practices.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Deploy SSL\/TLS certificates from trusted <a href=\"https:\/\/sectigostore.com\/blog\/what-is-a-certificate-authority-certification-authorities-explained\/\">certificate authorities<\/a> (CA) to secure all communication channels.<\/li><li>Alert users if an invalid SSL\/TLS certificate is detected or if the certificate chain verification process fails.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M4. Insecure Authentication<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Insecure authentication comes next on the OWASP mobile security vulnerabilities list. Before granting access, mobile apps need to verify the identity of the user. An authentication bypass is often executed by leveraging existing vulnerabilities, such as improper validation of service requests done by the mobile app\u2019s backend server. Mobile apps need to verify and maintain user identity, especially during the transmission of confidential data such as financial information.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Weaknesses in the authentication mechanism for mobile apps can be exploited by an attacker. Capitalizing on those weaknesses allows them to bypass password requirements or gain additional permissions leading to data theft and other damages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, what can you do to stop it?<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Avoid local authentication methods. Instead, shift this responsibility to the server-side and download application data only after a successful authentication.<\/li><li>Refrain from using vulnerable authentication methods (such as device identity), don\u2019t store passwords locally, implement multi-factor authentication (MFA), disallow using all four-digit PIN as passwords where feasible, etc.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M5. Insufficient Cryptography<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">There are two situations in which a system\u2019s cryptography may get compromised to reveal sensitive data:<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>The underlying algorithm used for encryption and decryption might be weak, or<\/li><li>The cryptographic process itself has implementation flaws.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Broken cryptography in mobile apps can be the result of one of several factors. This list of potential causes includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Bypassing built-in code encryption algorithms,<\/li><li>Improperly managing your digital keys, and<\/li><li>Using custom or deprecated encryption protocols.<\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Insufficient cryptographic controls can lead to the unauthorized retrieval of sensitive data (such as personal information about the user) from the device.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Apply strong <a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-175Br1.pdf\">cryptographic standards<\/a> as recommended by the National Institute of Standards and Technology (NIST).<\/li><li>Avoid storing any sensitive data on the device whenever possible<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M6. Insecure Authorization<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Not all users are created equal! Some users may be regular users, while others may require additional permissions and privileges, such as admin users. Poor authorization schemes fail to verify not who the user is but whether the user is sanctioned to access the resources they\u2019re requesting. Failure to properly enforce identity as well as the permissions given to the users allow hackers to log in as legitimate users and perform privilege escalation attacks.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">The impact of insecure authorization is similar to insecure authentication. They both may lead to data theft, reputational damage, and even noncompliance fines and penalties.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Ensure that for each request, backend processes verify that incoming identifiers associated with an identity match up and actually belong to the identity.<\/li><li>Validate the roles and permissions of an authenticated user using the information on backend systems and not based upon the information supplied by the mobile device.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M7. Client Code Quality<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This category on the list of OWASP mobile security risks is a bit of a catch-all for mobile client issues relating to faulty code implementations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker may pass crafted inputs to function calls made within an app in an attempt to execute them or observe the application\u2019s behavior. It may lead to degradation of performance, increased memory usage, etc. Note that the mistakes in code need to be fixed in a localized way since they arise on the mobile client and are different from server-side coding errors. There could be code-level mistakes in mobile apps that may lead to issues such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Format-string vulnerabilities,<\/li><li>Buffer overflows,<\/li><li>Integration with insecure third-party libraries,<\/li><li>Remote code execution<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Several apps rely on third-party libraries to build their applications, which often contain bugs and are not well tested. These issues are outside the control of the app developer since they don\u2019t own the code. More often than not with code-level bugs, the solution is to rewrite some of the code running on the device. But what else can you do?<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Poor code quality issues may lead to remote code execution and other vulnerabilities and issues that we\u2019ve already mentioned. Thankfully, there are a few things you can do to help mitigate these issues:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Test for buffer overflows, memory leaks, etc. using automated tools, rely on source code reviews, and write code that\u2019s easy to understand and well documented.&nbsp;<\/li><li>Use consistent coding patterns across the organization.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M8. Code Tampering<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">App stores sometimes contain tampered versions of mobile apps. An example of a modified app is where a hacker modifies the app\u2019s binary to include malicious content, install a backdoor, etc. Attackers can re-sign these counterfeit apps and publish the modified version onto third-party app stores. They can also deliver them to a victim directly via a phishing attack to trick them into downloading the app.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Tampering with the code can lead to revenue loss, identity theft, reputational and other damages.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The app must be able to identify any code integrity violation (if additional code has been added or modified) and react suitably to it at runtime. Using something like a code signing certificate could help to let users know about the code alterations.<\/li><li>Implement anti-tamper techniques that prevent illicit apps from executing via implementation of checksums, digital signatures, code hardening, and other validation methods.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M9. Reverse Engineering<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers may reverse engineer the app and decompile it to perform some code analysis. This is particularly dangerous since the attacker can understand, inspect, and modify the code to include harmful functionality or transmit undesired advertisements. Once they understand how the app operates, they can modify it using tools such as IDA Pro, Hopper, and other binary inspection tools. Once they get the app to behave in the desired way, they can recompile and run the app.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">In order to prevent reverse engineering, the attacker must be unable to de-obfuscate the code using tools like IDA Pro and Hopper.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M10. Extraneous Functionality<\/strong><strong><\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Sometimes developers may unintentionally leave backdoors or additional functionalities in mobile apps that aren\u2019t apparent to end users via the interface. These products may get released into the production environment with a feature not intended to be made available, creating security risks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These weaknesses can typically be exploited by hackers from their systems directly without requiring any participation from regular users. They may examine configuration files, analyze the binary, etc. to discover functionalities in the back-end system that cybercriminals can leverage to perform an attack.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Mobile Top 10 Remediation Measures for This Vulnerability:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most effective ways to prevent these types of mobile app vulnerabilities is to perform manual secure code review. What this does is allow you to:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Examine the mobile app\u2019s configuration settings to detect any hidden switches.<\/li><li>Ensure that the logs don\u2019t hold exceedingly descriptive statements about backend systems.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Wrapping Up<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/owasp.org\/www-project-mobile-top-10\/\">OWASP mobile security<\/a> vulnerabilities list serves as a starting point for organizations, developers, security professionals, and users who\u2019re just beginning to address their mobile security risks. It comes with definitions for each of the vulnerabilities discussed, example attack scenarios, prevention controls, and recommended mitigation strategies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But remember, tackling the OWASP mobile security vulnerabilities is only be the bare minimum. Be sure to go above and beyond to ensure your mobile apps are as secure as possible.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>According to Statista there are 3.5 billion smartphone users \u2014 that means a lot of people who could become victims of insecure mobile apps The OWASP Mobile Top 10 list&#8230;<\/p>\n","protected":false},"author":9,"featured_media":1936,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[13],"tags":[166,167,105],"class_list":["post-1932","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","tag-application-security","tag-mobile-apps","tag-mobile-security","post-with-tags"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>OWASP Mobile Top 10 Vulnerabilities &amp; Mitigation Strategies - InfoSec Insights<\/title>\n<meta name=\"description\" content=\"OWASP Mobile Top 10 calls attention to common mobile app vulnerabilities. Explore the current list (2016) &amp; their remediation strategies\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OWASP Mobile Top 10 Vulnerabilities &amp; Mitigation Strategies - InfoSec Insights\" \/>\n<meta property=\"og:description\" content=\"OWASP Mobile Top 10 calls attention to common mobile app vulnerabilities. Explore the current list (2016) &amp; their remediation strategies\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/\" \/>\n<meta property=\"og:site_name\" content=\"InfoSec Insights\" \/>\n<meta property=\"article:published_time\" content=\"2020-12-21T18:23:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-12-21T18:27:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-feature.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"1000\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Lumena Mukherjee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lumena Mukherjee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/\"},\"author\":{\"name\":\"Lumena Mukherjee\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/8fc401352fbdfcfdf08996099c088b1f\"},\"headline\":\"OWASP Mobile Top 10 Vulnerabilities &#038; Mitigation Strategies\",\"datePublished\":\"2020-12-21T18:23:38+00:00\",\"dateModified\":\"2020-12-21T18:27:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/\"},\"wordCount\":2216,\"image\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/owasp-mobile-top-10-feature.jpg\",\"keywords\":[\"application security\",\"mobile apps\",\"mobile security\"],\"articleSection\":[\"Cyber Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/\",\"name\":\"OWASP Mobile Top 10 Vulnerabilities & Mitigation Strategies - InfoSec Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/owasp-mobile-top-10-feature.jpg\",\"datePublished\":\"2020-12-21T18:23:38+00:00\",\"dateModified\":\"2020-12-21T18:27:53+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/8fc401352fbdfcfdf08996099c088b1f\"},\"description\":\"OWASP Mobile Top 10 calls attention to common mobile app vulnerabilities. Explore the current list (2016) & their remediation strategies\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/owasp-mobile-top-10-feature.jpg\",\"contentUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/owasp-mobile-top-10-feature.jpg\",\"width\":1600,\"height\":1000},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/owasp-mobile-top-10\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OWASP Mobile Top 10 Vulnerabilities &#038; Mitigation Strategies\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/\",\"name\":\"InfoSec Insights\",\"description\":\"SectigoStore.com Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/8fc401352fbdfcfdf08996099c088b1f\",\"name\":\"Lumena Mukherjee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g\",\"caption\":\"Lumena Mukherjee\"},\"description\":\"Lumena is a cybersecurity consultant, tech writer, and regular columnist for InfoSec Insights. She is currently pursuing her masters in cybersecurity and has a passion for helping companies implement better security programs to protect their customers' data.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OWASP Mobile Top 10 Vulnerabilities & Mitigation Strategies - InfoSec Insights","description":"OWASP Mobile Top 10 calls attention to common mobile app vulnerabilities. Explore the current list (2016) & their remediation strategies","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/","og_locale":"en_US","og_type":"article","og_title":"OWASP Mobile Top 10 Vulnerabilities & Mitigation Strategies - InfoSec Insights","og_description":"OWASP Mobile Top 10 calls attention to common mobile app vulnerabilities. Explore the current list (2016) & their remediation strategies","og_url":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/","og_site_name":"InfoSec Insights","article_published_time":"2020-12-21T18:23:38+00:00","article_modified_time":"2020-12-21T18:27:53+00:00","og_image":[{"width":1600,"height":1000,"url":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-feature.jpg","type":"image\/jpeg"}],"author":"Lumena Mukherjee","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lumena Mukherjee","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/#article","isPartOf":{"@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/"},"author":{"name":"Lumena Mukherjee","@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/8fc401352fbdfcfdf08996099c088b1f"},"headline":"OWASP Mobile Top 10 Vulnerabilities &#038; Mitigation Strategies","datePublished":"2020-12-21T18:23:38+00:00","dateModified":"2020-12-21T18:27:53+00:00","mainEntityOfPage":{"@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/"},"wordCount":2216,"image":{"@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/#primaryimage"},"thumbnailUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-feature.jpg","keywords":["application security","mobile apps","mobile security"],"articleSection":["Cyber Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/","url":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/","name":"OWASP Mobile Top 10 Vulnerabilities & Mitigation Strategies - InfoSec Insights","isPartOf":{"@id":"https:\/\/sectigostore.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/#primaryimage"},"image":{"@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/#primaryimage"},"thumbnailUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-feature.jpg","datePublished":"2020-12-21T18:23:38+00:00","dateModified":"2020-12-21T18:27:53+00:00","author":{"@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/8fc401352fbdfcfdf08996099c088b1f"},"description":"OWASP Mobile Top 10 calls attention to common mobile app vulnerabilities. Explore the current list (2016) & their remediation strategies","breadcrumb":{"@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/#primaryimage","url":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-feature.jpg","contentUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/12\/owasp-mobile-top-10-feature.jpg","width":1600,"height":1000},{"@type":"BreadcrumbList","@id":"https:\/\/sectigostore.com\/blog\/owasp-mobile-top-10\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sectigostore.com\/blog\/"},{"@type":"ListItem","position":2,"name":"OWASP Mobile Top 10 Vulnerabilities &#038; Mitigation Strategies"}]},{"@type":"WebSite","@id":"https:\/\/sectigostore.com\/blog\/#website","url":"https:\/\/sectigostore.com\/blog\/","name":"InfoSec Insights","description":"SectigoStore.com Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sectigostore.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/8fc401352fbdfcfdf08996099c088b1f","name":"Lumena Mukherjee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g","caption":"Lumena Mukherjee"},"description":"Lumena is a cybersecurity consultant, tech writer, and regular columnist for InfoSec Insights. She is currently pursuing her masters in cybersecurity and has a passion for helping companies implement better security programs to protect their customers' data."}]}},"_links":{"self":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts\/1932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/comments?post=1932"}],"version-history":[{"count":0,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts\/1932\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/media\/1936"}],"wp:attachment":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/media?parent=1932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/categories?post=1932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/tags?post=1932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}