List of Top security risk/attack scenarios for android application

Question

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: https://www.owasp.org/index.php/OWASP_Mobile_Security_Project

I would like to know which of the ten and if applicable how the threat is generated and how it can be mitigated.

Answer 1

Your question is probably not answerable here in its current form. The entire point of the OWASP mobile security project is that there are a great many threats, of which the top ten are listed, and a large number of mitigating controls or activities.

1. Insecure Data Storage
2. Weak Server Side Controls
3. Insufficient Transport Layer Protection
4. Client Side Injection
5. Poor Authorization and Authentication
6. Improper Session Handling
7. Security Decisions Via Untrusted Inputs
8. Side Channel Data Leakage
9. Broken Cryptography
10. Sensitive Information Disclosure

If you read the page you linked to, you will see their summary of risk, and a current list of mitigating controls for each of the top ten, and this is still a work in progress so the expectation is that the community will help to build more detail in to the document.

All those ten are applicable to Android phones, so read the risk summary for each one and look at your application to see if you use any of the mitigation controls.

Answer 2

Aside from the vulnerabilities mentioned above by Rory Alsop, I also highly encourage you to look at Android specific vulnerabilities that researchers have come across. A few links :-

• Look at "Comdroid" and the research behind it.
• Look at the research done by the same done on Android permissions - "Android Permissions demystified"
• There is an excellent Defcon 19 talk named "7 ways to hang yourself using Google Android" -- its a must watch.