Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Initial situation:

A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the service side.

Problem / Security Threat:

The WebView element of the android and iOS plattforms allow to create a malicious web browser that unveils and modifies session cookies. webView.loadUrl("javascript:document.cookie=’’;");. If the attacker already figured out, how the double submitted cookie looks like, (In this case it's the AuthenticationToken) he is able to create a malicious RESTBrowser. Therefore he adds the already known CSRFToken to the document object model and thus bypasses the CSRF countermeasure. Is that right so far?

Possible Preventions:

So far I have no idea how I can prevent an attacker from creating und publishing such a malicious mobile application, as well to prevent the service from beeing accessed via malicious mobile applications. I know about the existence of the User-Agent header and that the service can use this information to reject requests from others than specific browsers. But I'm sure that also this header can be manipulated within the WebView.

What are effective countermeasures aginst CSRF in contex of malicious mobile applications?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

It's an app. It can send your server any cookies it wants. It can save the password as the user types it. It's in complete control. You have no more "defense" against this than you do against Mozilla Firefox or Google Chrome.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.