Difference between revisions of "Projects/OWASP Mobile Security Project - Top Ten Mobile Risks"

From OWASP
Jump to: navigation, search
(29 intermediate revisions by 3 users not shown)
Line 1: Line 1:
== Call For Volunteers ==
+
<center><br style="clear:both" />
 +
{| align="center" style="width:45%; background-color:#FFFFFF; border:1px solid #a7d7f9; -moz-border-radius: 9px;-webkit-border-radius: 9px; border-radius: 9px; padding:1px;" id="social_bookmarks" class="noprint"
 +
|-
 +
|
 +
<div class="plainlinks" align="center">
 +
'''Share this:'''&nbsp;
 +
<span title="Share via e-mail" class="plainlinks">[[File:social-email.png|E-mail this story|link=mailto:?subject={{FULLPAGENAMEE}}&body={{FULLPAGENAMEE}}:%0A{{fullurle:{{FULLPAGENAME}}}}]]</span>
 +
<span title="Share on Facebook">[[File:social-facebook.png|Bookmark with Facebook|link=http://www.facebook.com/sharer.php?u={{fullurle:{{FULLPAGENAME}}}}&t={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on Digg">[[File:social-digg.png|Share on Digg.com|link=http://digg.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}} }}]]</span>
 +
<span  title="Share on delicious">[[File:social-delicious.png|16px|Share on delicious|link=http://delicious.com/post?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on reddit">[[File:social-reddit.png|Share on reddit.com|link=http://reddit.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on StumbleUpon">[[File:social-stumbleupon.png|16px|Share on stumbleupon.com|link=http://stumbleupon.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on LinkedIn">[[File:social-linkedin.png|16px|Share on LinkedIn.com|link=http://www.linkedin.com/shareArticle?mini=true&url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span title="Share on Twitter">[[File:social-twitter.png|alt=Share on twitter.com|link=http://twitter.com/?status={{fullurle:{{FULLPAGENAME}}}}|Share on twitter.com]]</span>
 +
<span title="Seed on Newsvine">[[File:social-newsvine.png|16px|Seed on Newsvine|link=http://www.newsvine.com/_wine/save?popoff=1&u={{fullurle:{{FULLPAGENAME}}}}]]</span>
 +
</div>
 +
|}
 +
</center>
 +
== About this list  ==
 +
In 2013 we polled the industry for new vulnerability statistics in the field of mobile applications. What you see here is a result of that data and a representation of the mobile application threat landscape.
  
We are pleased to announce a call for participation to help shape the OWASP Mobile Top 10 Risks. This “Top 10” initiative is intended to help organizations determine how to best apply development and security resources to better protect their mobile applications and data.
 
  
In order to compile the most thorough and universally accepted guidance possible, we are reaching out to software developers, security consultants, and thought leaders from all industries to participate. This includes independent developers and consultants, startups, large consultancies, and large development companies. If you have an interest in mobile application security and the expertise to contribute, we invite you to get involved with this initiative. The OWASP organization is built on openness and transparency, and our vision is for this initiative to adhere to these very same high standards. Participation is open and highly encouraged for all.  
+
Our road-map for 2014 includes:
 +
[[File:2014-01-26 20-23-29.png|right|550px]]
 +
* More updates to the wiki content; including cross-linking to testing guides, more visual exercises, etc.
 +
* A PDF release.
  
For more information on how you can participate in this very important initiative, please visit the detailed announcement page: [https://www.owasp.org/index.php?title=OWASP_Mobile_Security_Project_Call_For_Volunteers Call For Volunteers]
 
  
<br>
+
This list is still a work in progress. We are small group doing this work and could use more help! If you are interested, please contact one of the project leads.
 +
 
 +
Feel free to visit [https://groups.google.com/a/owasp.org/forum/#!forum/owasp-mobile-top-10-risks the mailing list] as well!
 +
 
 +
== Top 10 Mobile Risks - Re-Release Candidate 2014 v1.0 ==
 +
*[[Mobile_Top_10_2014-M1|M1: Weak Server Side Controls ]]
 +
*[[Mobile_Top_10_2014-M2|M2: Insecure Data Storage ]]
 +
*[[Mobile_Top_10_2014-M3|M3: Insufficient Transport Layer Protection ]]
 +
*[[Mobile_Top_10_2014-M4|M4: Unintended Data Leakage ]]
 +
*[[Mobile_Top_10_2014-M5|M5: Poor Authorization and Authentication ]]
 +
*[[Mobile_Top_10_2014-M6|M6: Broken Cryptography ]]
 +
*[[Mobile_Top_10_2014-M7|M7: Client Side Injection ]]
 +
*[[Mobile_Top_10_2014-M8|M8: Security Decisions Via Untrusted Inputs ]]
 +
*[[Mobile_Top_10_2014-M9|M9: Improper Session Handling ]]
 +
*[[Mobile_Top_10_2014-M10|M10: Lack of Binary Protections ]]
 +
 
 +
 
 +
== Project Leads, Credit, and Contributions ==
 +
 
 +
* ''' [[Mobile_Top_Contributions|Mobile Top Ten Contributions Page ]] '''
 +
 
  
== About this list  ==
 
  
The below list is the result of a brainstorming session conducted by a small number of security consultants and application testers. For this list to carry weight going forward, it should be derived from the larger community that has had experience reviewing and testing mobile applications for security. A new initiative has been proposed to survey organizations for anonymous vulnerability data, and use this data to build the next version of this list.
+
== Project Methodology ==
  
<br>
+
* '''We adhered loosely to the [https://www.owasp.org/index.php/Top_10_2013/ProjectMethodology OWASP Web Top Ten Project methodology]. '''
  
== Top 10 Mobile Risks Draft 0.1  ==
 
  
#Insecure or unnecessary client-side data storage
 
#Lack of data protection in transit
 
#Personal data leakage
 
#Failure to protect resources with strong authentication
 
#Failure to implement least privilege authorization policy
 
#Client-side injection
 
#Client-side DOS
 
#Malicious third-party code
 
#Client-side buffer overflow
 
#Failure to apply server-side controls
 
  
== Additional Considerations  ==
+
== Archive ==
 +
* The list below is the OLD release candidate v1.0 of the OWASP Top 10 Mobile Risks. &nbsp;This list was initially released on September 23, 2011 at Appsec USA. &nbsp;
  
#Abuse of client side paid resources
+
*** The original presentation can be found here:&nbsp;[http://www.slideshare.net/JackMannino/owasp-top-10-mobile-risks SLIDES]<br>
#Failure to properly handle inbound SMS messages
+
*** The corresponding video can be found here: [http://www.youtube.com/watch?v=GRvegLOrgs0 VIDEO]
#Failure to properly handle outbound SMS messages
+
*** [[Mobile_Top_10_2012|2011-12 Mobile Top Ten for archive purposes]]
#Malicious / Fake applications from appstore
+
__NOTOC__
#Ability of one application to view data or communicate with other applications
+
#Switching networks during a transaction
+
#Failure to Protecting Sensitive Data a rest
+
#Failure to disable insecure platform features in application (caching of keystrokes, screen data)
+

Revision as of 20:00, 24 February 2014


About this list

In 2013 we polled the industry for new vulnerability statistics in the field of mobile applications. What you see here is a result of that data and a representation of the mobile application threat landscape.


Our road-map for 2014 includes:

2014-01-26 20-23-29.png
  • More updates to the wiki content; including cross-linking to testing guides, more visual exercises, etc.
  • A PDF release.


This list is still a work in progress. We are small group doing this work and could use more help! If you are interested, please contact one of the project leads.

Feel free to visit the mailing list as well!

Top 10 Mobile Risks - Re-Release Candidate 2014 v1.0


Project Leads, Credit, and Contributions


Project Methodology


Archive

  • The list below is the OLD release candidate v1.0 of the OWASP Top 10 Mobile Risks.  This list was initially released on September 23, 2011 at Appsec USA.