Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

12/7/2017
01:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Man-in-the-Middle Flaw in Major Banking, VPN Apps Exposes Millions

New research from University of Birmingham emphasizes importance of securing high-risk mobile apps.

[This article was updated on 12/11 to clarify the Bank of America app cited by researchers was Bank of America Health]

Researchers from the UK have uncovered a serious vulnerability in the way nine banking and VPN apps handle encrypted communication that puts tens of millions of users at risk of man-in-the-middle (MitM) attacks. Among those impacted are two of the largest global banks - Bank of America and HSBC - as well as one of the world's most popular VPN providers, TunnelBear.

"Our tests find that apps from some of the world's largest banks contain the flaw, which if exploited, could enable an attacker to decrypt, view and modify traffic - including log-in credentials - from the users of the app," write Chris Mcmahon Stone, Tom Chothia, and Flavio Garcia of University of Birmingham, who detailed the discovery in a paper released yesterday.

The findings came as part of a study involving a new blackbox automated-testing mechanism the team came up with to find applications that implement TLS certificate-pinning but fail to verify the hostname, leaving them open to MitM attacks. Dubbed Spinner, the tool uses the Censys Internet scanning engine to scale up what has in the past been a costly, manual process to check. As a part of the release of their paper, the researchers also released Spinner under a Creative Commons License.

The initial discovery of the nine applications came by way of a study using Spinner of 400 iOS and Android applications. All of this sample set control a high degree of sensitive data or transactions, including banking, stock trading, cryptocurrency, and VPN apps.

This latest discovery shines new spotlight on the risks posed by insecurely developed and implemented mobile applications. The stakes are growing for mobile apps, as they're increasingly leveraged for high-risk and high-value transactions in finance, healthcare, manufacturing, and other areas. Unfortunately, the culture and maturity of appsec practices within the mobile app development field has not kept up with the growing risk profile of these apps.

Just last week, High-Tech Bridge released a study that showed among the top 30 cryptocurrency apps on Google Play with 500,000 installations or more, 94% contained at least three medium-risk vulnerabilities and 77% contained at least two high-risk vulnerabilities.

In a good news-bad news analysis of the situation, Ilia Kolochenko, CEO of High-Tech Bridge, explains that vulnerabilities like the one University of Birmingham researchers found and his own team found are still not as alluring as other lower-hanging fruit.

"In most of the cases, exploitation of a mobile app vulnerability requires some pre-existing conditions, such as an already installed malicious app on the same device or attacker's access to the victim’s data channel" such as public wi-fi, Kolochenko says. "All of this makes mobile apps a not-very attractive target for cybercriminals, who would rather target the mobile backend."

As he explains, the bad news is that mobile app vulnerabilities are just the tip of the iceberg in terms of mobile risk exposure, as attacks against APIs and Web services are easier for attackers to scale and just as prevalent in the deployment of mobile apps. The firm's study found that 77% of cryptocurrency applications did not have any hardening or protection of their backend. This isn't just a cryptocurrency app problem.

It is rampant elsewhere: The sloppy level of care with APIs was in clear evidence with a different report published by researchers with Appthority a few weeks ago. They found a vulnerability where a contingent of developers using the Twilio REST API or SDK were hardcoding credentials in mobile apps: Appthority found 170 apps in official app stores were affected by the vulnerability, with millions of users at risk in that case.

It's a disconcerting trend given the acceleration of financial management via mobile devices worldwide. Take Bank of America, which was one of the organizations named in this research. In the case of this particular vulnerability discovery, researchers found the flaw not in the main Bank of America banking app but in its Bank of America Health app, designed for managing HSA accounts. Researchers estimate this particular app racked up between 100,000 to 500,000 installs during its lifecycle--Bank of America says that it updated the app on disclosure from the researchers and has since retired the app with a new version . Mobile banking is increasingly a lynchpin of B of A's future strategy, with mobile usage among its banking customers growing 19% year-over-year, and traffic at its financial centers dwindling by 4%. At this point, nearly a quarter of all of its deposits are now made through mobile devices, according to recent reports.  And that's just within mainline banking--other lines of business like those supported by the vulnerable health app are also going mobile.

This is an industry-wide trend for financial management.According to analysts with App Annie, the number of app sessions initiated in the US has increased by 50% since 2014, up to 22 billion last year. It all goes to prove that the stakes keep growing and so does the mobile attack surface for firms dealing in mobile financial management.

Related Content:

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7914
PUBLISHED: 2020-02-21
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.
CVE-2016-4606
PUBLISHED: 2020-02-21
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
CVE-2020-5243
PUBLISHED: 2020-02-21
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent hea...
CVE-2019-14688
PUBLISHED: 2020-02-20
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial produc...
CVE-2019-19694
PUBLISHED: 2020-02-20
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manipulate a key file at a certain time during the system startup process to disable the product's malware protection functions or the ...