5

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list.

Bank is a very special client. They really concern about security stuff. However, in the same time, they want to have very flexibility and great feature to comfort their users. I really think both security and convenience do not relate to each other.

So what have I done are:

  • Use SSL to communicate from app and web API.
  • Using token authentication to ensure if the request to API is from official app. Most likely, I will use a shared token key that is updated every month. The token will be based on agreed random string, android id and the application id.
  • To prevent reversed engineering, I use proguard for obfuscate the app itself. I am not really sure how secure are proguard but Java Class are very easily reversible. Hopefully, with proguard it may makes it harder.
  • I also use MCSSID from simcard and Android ID to validate each user login and when application launched. Once, the SIMcard is changed, user need to re-register all information (such as CC number, mobile phone and OTP from bank). Also, the server will check once the android ID is not match. The server will flag the transaction with higher risk. Bank may call them to verify about their transaction.
  • The app will not be able to run on Rooted devices. If the devices is rooted, it will not allow to continue and finish the running activity after alert.
  • Also, in the future, I'm planning to regularly check user behavior login (such as, Time, Location based) to ensure if any unusual activity will be flag as high Risk

From steps taken above, is there anything preventive action that I can push more in the security sides?

Thanks

  • 2
    Relying on client-side security is pointless. Your app will be reverse-engineered if it is a high-value target. You have to undertake a more formal threat analysis, and protect the protocol and valuable data, not the client app's source. – Deer Hunter May 7 '14 at 8:43
  • @DeerHunter I'm affraid it will be hard to keep the security if the code is compromised, especially for the most recent code. How long does it take to reverse-engineered an apk? I have put all efforts to have very least information stored in client side. All proccessing are done in server. Maybe you should give an answer below. You mentioned a good point – William Calvin May 7 '14 at 11:13
4

Obfuscation is a delaying tactic, not a solution. You have to work on the assumption that the application and phone will be compromised. Treat it like you would a browser, use the app to send and display information only:

  • Do not store any sensitive data locally
  • Handle all processing on the bank's servers
  • Do not cache any passwords, account details, or transaction data

Encourage the bank to perform a risk analysis on the functionality they want the app to have, and evaluate whether the functionality should be included. Do your own analysis and warn them about anything you aren't confident you can protect.

There's no point in blocking use on rooted phones, many people root their phones for legitimate reasons and you don't want to deny service on that basis. If you design your app right it won't matter, which is the whole point.

  • If I do obfuscate every month with new obfuscation everytime, does it help to ensure confidentiality of the code? This is what I worry most. It is okay to have older version of the code, but the most recent code should be able not shown to the public. – William Calvin May 7 '14 at 11:09
0

You should check Owasp mobile development guide.

Also you can use Ssl pinning for mobile application.

As you know a lot of banking malware like mobile versions of Zeus or Spyeye. So you can implement two way authentication to your application like Google Authenticator

0

Think about limiting app functionality. In the Netherlands all banks use a special device for normal bank login. You put in your bank card, then enter the PIN code, then you enter a code on the device, get a code back and enter that to login to the site.

For an app this won't work, so they created a special login for smartphones. You link the app to the account, and it works with a simple PIN code. Functionality it limited. You can only transfer money to bank accounts that you have sent money to in the past 18 months. You can set the maximum amount of money to transfer per day via the normal site.

You can send bigger amounts to unknown accounts via the app, but then you need the login device. I guess your bank doesn't use such a login device. Limiting functionality is still a good option I think.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.