Difference between revisions of "Projects/OWASP Mobile Security Project - Top Ten Mobile Risks"

From OWASP
Jump to: navigation, search
(18 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 +
<center><br style="clear:both" />
 +
{| align="center"  style="width:45%; background-color:#FFFFFF; border:1px solid #a7d7f9; -moz-border-radius: 9px;-webkit-border-radius: 9px; border-radius: 9px; padding:1px;" id="social_bookmarks" class="noprint"
 +
|-
 +
|
 +
<div class="plainlinks" align="center">
 +
'''Share this:'''&nbsp;
 +
<span title="Share via e-mail" class="plainlinks">[[File:social-email.png|E-mail this story|link=mailto:?subject={{FULLPAGENAMEE}}&body={{FULLPAGENAMEE}}:%0A{{fullurle:{{FULLPAGENAME}}}}]]</span>
 +
<span title="Share on Facebook">[[File:social-facebook.png|Bookmark with Facebook|link=http://www.facebook.com/sharer.php?u={{fullurle:{{FULLPAGENAME}}}}&t={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on Digg">[[File:social-digg.png|Share on Digg.com|link=http://digg.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}} }}]]</span>
 +
<span  title="Share on delicious">[[File:social-delicious.png|16px|Share on delicious|link=http://delicious.com/post?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on reddit">[[File:social-reddit.png|Share on reddit.com|link=http://reddit.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on StumbleUpon">[[File:social-stumbleupon.png|16px|Share on stumbleupon.com|link=http://stumbleupon.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on LinkedIn">[[File:social-linkedin.png|16px|Share on LinkedIn.com|link=http://www.linkedin.com/shareArticle?mini=true&url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span title="Share on Twitter">[[File:social-twitter.png|alt=Share on twitter.com|link=http://twitter.com/?status={{fullurle:{{FULLPAGENAME}}}}|Share on twitter.com]]</span>
 +
<span title="Seed on Newsvine">[[File:social-newsvine.png|16px|Seed on Newsvine|link=http://www.newsvine.com/_wine/save?popoff=1&u={{fullurle:{{FULLPAGENAME}}}}]]</span>
 +
</div>
 +
|}
 +
</center>
 
== About this list  ==
 
== About this list  ==
 +
In 2013 we polled the industry for new vulnerability statistics in the field of mobile applications. What you see here is a result of that data and a representation of the mobile application threat landscape.
  
The list below is release candidate v1.0 of the OWASP Top 10 Mobile Risks. &nbsp;This list was initially released on September 23, 2011 at Appsec USA. &nbsp;
 
  
'''An effort to refresh the Top 10 for 2013 is currently underway. Details can be found here: [http://owasp.blogspot.com/2013/05/2013-owasp-mobile-top-10-call-for-data.html OWASP Mobile Top 10 Call For Data]'''''Italic text''
+
Our road-map for 2014 includes:
 +
[[File:2014-01-26 20-23-29.png|right|550px]]
 +
* More updates to the wiki content; including cross-linking to testing guides, more visual exercises, etc.
 +
* A PDF release.
  
The original presentation can be found here:&nbsp;[http://www.slideshare.net/JackMannino/owasp-top-10-mobile-risks SLIDES]<br>
 
  
The corresponding video can be found here: [http://www.youtube.com/watch?v=GRvegLOrgs0 VIDEO]
+
This list is still a work in progress. We are small group doing this work and could use more help! If you are interested, please contact one of the project leads.
  
== Top 10 Mobile Risks, Release Candidate v1.0 ==
+
Feel free to visit [https://groups.google.com/a/owasp.org/forum/#!forum/owasp-mobile-top-10-risks the mailing list] as well!
[[File:Topten.png|right|550px]]
+
 
*[[Mobile_Top_10_2012-M1|M1: Insecure Data Storage ]]  
+
== Top 10 Mobile Risks - Re-Release Candidate 2014 v1.0 ==
*[[Mobile_Top_10_2012-M2|M2: Weak Server Side Controls ]]
+
*[[Mobile_Top_10_2014-M1|M1: Weak Server Side Controls ]]  
*[[Mobile_Top_10_2012-M3|M3: Insufficient Transport Layer Protection ]]
+
*[[Mobile_Top_10_2014-M2|M2: Insecure Data Storage ]]
*[[Mobile_Top_10_2012-M4|M4: Client Side Injection ]]
+
*[[Mobile_Top_10_2014-M3|M3: Insufficient Transport Layer Protection ]]
*[[Mobile_Top_10_2012-M5|M5: Poor Authorization and Authentication ]]
+
*[[Mobile_Top_10_2014-M4|M4: Unintended Data Leakage ]]
*[[Mobile_Top_10_2012-M6|M6: Improper Session Handling ]]
+
*[[Mobile_Top_10_2014-M5|M5: Poor Authorization and Authentication ]]
*[[Mobile_Top_10_2012-M7|M7: Security Decisions Via Untrusted Inputs ]]
+
*[[Mobile_Top_10_2014-M6|M6: Broken Cryptography ]]
*[[Mobile_Top_10_2012-M8|M8: Side Channel Data Leakage ]]
+
*[[Mobile_Top_10_2014-M7|M7: Client Side Injection ]]
*[[Mobile_Top_10_2012-M9|M9: Broken Cryptography ]]
+
*[[Mobile_Top_10_2014-M8|M8: Security Decisions Via Untrusted Inputs ]]
*[[Mobile_Top_10_2012-M10|M10: Sensitive Information Disclosure ]]
+
*[[Mobile_Top_10_2014-M9|M9: Improper Session Handling ]]
 +
*[[Mobile_Top_10_2014-M10|M10: Lack of Binary Protections ]]
 +
 
 +
 
 +
== Project Leads, Credit, and Contributions ==
 +
 
 +
* ''' [[Mobile_Top_Contributions|Mobile Top Ten Contributions Page ]] '''
 +
 
 +
 
 +
 
 +
== Project Methodology ==
 +
 
 +
* '''We adhered loosely to the [https://www.owasp.org/index.php/Top_10_2013/ProjectMethodology OWASP Web Top Ten Project methodology]. '''
 +
 
 +
 
 +
 
 +
== Archive ==
 +
* The list below is the OLD release candidate v1.0 of the OWASP Top 10 Mobile Risks. &nbsp;This list was initially released on September 23, 2011 at Appsec USA. &nbsp;
 +
 
 +
*** The original presentation can be found here:&nbsp;[http://www.slideshare.net/JackMannino/owasp-top-10-mobile-risks SLIDES]<br>
 +
*** The corresponding video can be found here: [http://www.youtube.com/watch?v=GRvegLOrgs0 VIDEO]
 +
*** [[Mobile_Top_10_2012|2011-12 Mobile Top Ten for archive purposes]]
 +
__NOTOC__

Revision as of 20:00, 24 February 2014


About this list

In 2013 we polled the industry for new vulnerability statistics in the field of mobile applications. What you see here is a result of that data and a representation of the mobile application threat landscape.


Our road-map for 2014 includes:

2014-01-26 20-23-29.png
  • More updates to the wiki content; including cross-linking to testing guides, more visual exercises, etc.
  • A PDF release.


This list is still a work in progress. We are small group doing this work and could use more help! If you are interested, please contact one of the project leads.

Feel free to visit the mailing list as well!

Top 10 Mobile Risks - Re-Release Candidate 2014 v1.0


Project Leads, Credit, and Contributions


Project Methodology


Archive

  • The list below is the OLD release candidate v1.0 of the OWASP Top 10 Mobile Risks.  This list was initially released on September 23, 2011 at Appsec USA.