Insecure Authentication/Authorization

Let’s start with M1: Insecure Authentication/Authorization. This category covers various types of flaws that allow attackers to access or perform actions on mobile applications without proper verification or permission. Authentication is the process of verifying who you are, while authorization is the process of verifying what you can do. For example, when you log in to your email app, you need to provide your username and password (authentication), and then you can read, write, or delete your emails (authorization).

Insecure authentication/authorization can happen when mobile applications do not implement or enforce strong and secure mechanisms to verify and control user access and actions. For example, some common flaws are:

• Weak or default passwords: Some applications allow users to set weak passwords (such as “123456” or “password”) or use default passwords (such as “admin” or “guest”) that are easy to guess or crack by attackers.

• No password protection: Some applications do not require users to enter a password at all, or only ask for a password once and then remember it forever, even if the device is lost or stolen.

• Biometric bypass: Some applications use biometric features (such as fingerprint or face recognition) to authenticate users, but they do not check if the biometric data is genuine or spoofed by attackers using fake fingerprints or masks.

• Session hijacking: Some applications do not manage user sessions properly, and they allow attackers to steal or reuse session tokens (such as cookies or headers) that identify users on the server side, and then impersonate them or access their data.

• Broken object level authorization: Some applications do not check if users have the right to access or modify specific objects (such as files, records, or resources) on the server side, and they allow attackers to manipulate the object identifiers (such as IDs or URLs) in the requests and access or modify other users’ objects.

These flaws can lead to serious consequences, such as data breach, identity theft, account takeover, fraud, privilege escalation, etc. Therefore, it is very important for mobile applications to implement and enforce secure authentication/authorization mechanisms, such as:

• Strong password policy: Applications should require users to set strong passwords that are long, complex, unique, and random, and they should also enforce password expiration, lockout, and change policies.

• Password protection: Applications should require users to enter a password every time they access the application, or at least after a certain period of inactivity or when switching contexts. They should also encrypt and store passwords securely on the device and the server side.

• Biometric verification: Applications should use biometric features as an additional factor of authentication, not as a replacement for passwords. They should also verify the biometric data using secure algorithms and hardware modules that prevent spoofing attacks.

• Session management: Applications should generate and use secure and random session tokens that are tied to specific devices and users. They should also expire and invalidate session tokens after a certain period of time or when logging out.

• Object level authorization: Applications should check if users have the right to access or modify specific objects on the server side based on their roles and permissions. They should also use secure and unpredictable object identifiers that cannot be guessed or manipulated by attackers.

I hope this explanation helps you understand what M1: Insecure Authentication/Authorization is and why it is important. If you want to learn more about this category and how to prevent it, you can check out these resources:

• [M1-Insecure Authentication/Authorization | OWASP Foundation]: The official website of the OWASP Mobile Top 10 project. It contains detailed information about this category and links to other useful resources.

• [Mobile App Authentication & Authorization Best Practices]: A blog post that provides an overview of the best practices for mobile app authentication and authorization.

• [Mobile App Security Testing | Cybrary]: A course that teaches you how to test and secure mobile applications against various security risks.