Difference between revisions of "Projects/OWASP Mobile Security Project - Top Ten Mobile Risks"

From OWASP
Jump to: navigation, search
m (Additional Considerations)
m
 
(48 intermediate revisions by 7 users not shown)
Line 1: Line 1:
== About this list ==
+
<center><br style="clear:both" />
 +
{| align="center"  style="width:45%; background-color:#FFFFFF; border:1px solid #a7d7f9; -moz-border-radius: 9px;-webkit-border-radius: 9px; border-radius: 9px; padding:1px;" id="social_bookmarks" class="noprint"
 +
|-
 +
|
 +
<div class="plainlinks" align="center">
 +
'''Share this:'''&nbsp;
 +
<span title="Share via e-mail" class="plainlinks">[[File:social-email.png|E-mail this story|link=mailto:?subject={{FULLPAGENAMEE}}&body={{FULLPAGENAMEE}}:%0A{{fullurle:{{FULLPAGENAME}}}}]]</span>
 +
<span title="Share on Facebook">[[File:social-facebook.png|Bookmark with Facebook|link=http://www.facebook.com/sharer.php?u={{fullurle:{{FULLPAGENAME}}}}&t={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on Digg">[[File:social-digg.png|Share on Digg.com|link=http://digg.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}} }}]]</span>
 +
<span  title="Share on delicious">[[File:social-delicious.png|16px|Share on delicious|link=http://delicious.com/post?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on reddit">[[File:social-reddit.png|Share on reddit.com|link=http://reddit.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on StumbleUpon">[[File:social-stumbleupon.png|16px|Share on stumbleupon.com|link=http://stumbleupon.com/submit?url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span  title="Share on LinkedIn">[[File:social-linkedin.png|16px|Share on LinkedIn.com|link=http://www.linkedin.com/shareArticle?mini=true&url={{fullurle:{{FULLPAGENAME}}}}&title={{urlencode:{{FULLPAGENAME}}}}]]</span>
 +
<span title="Share on Twitter">[[File:social-twitter.png|alt=Share on twitter.com|link=http://twitter.com/?status={{fullurle:{{FULLPAGENAME}}}}|Share on twitter.com]]</span>
 +
<span title="Seed on Newsvine">[[File:social-newsvine.png|16px|Seed on Newsvine|link=http://www.newsvine.com/_wine/save?popoff=1&u={{fullurle:{{FULLPAGENAME}}}}]]</span>
 +
</div>
 +
|}
 +
</center>
 +
= The Mobile Top Ten 2016 =
  
The below list is the result of a brainstorming session conducted by a small number of security consultants and application testers. For this list to carry weight going forward, it should be derived from the larger community that has had experience reviewing and testing mobile applications for security. A new initiative has been proposed to survey organizations for anonymous vulnerability data, and use this data to build the next version of this list.
+
Following a 90-day review and publication of the release candidate, we determined that the release candidate was ready for final publication. The 2016 list has now been published and can be found here: [https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10 OWASP Mobile Top Ten 2016]
  
 +
Feel free to visit [https://groups.google.com/a/owasp.org/forum/#!forum/owasp-mobile-top-10-risks the mailing list] as well!
  
== Top 10 Mobile Risks Draft 0.1 ==
+
== 2015 Mobile Top Ten Analysis Results ==
 +
Are you interested in what the data collection for the 2015 list looks like? Check out the final synthesis... [[Media:2015 Data Synthesis Results.pptx]]
  
# Insecure or unnecessary client-side data storage
+
We are fleshing out the new Mobile Top Ten at [[Projects/OWASP_Mobile_Security_Project_-2015_Scratchpad]]. Have a look.
# Lack of data protection in transit
 
# Personal data leakage
 
# Failure to protect resources with strong authentication
 
# Failure to implement least privilege authorization policy
 
# Client-side injection
 
# Client-side DOS
 
# Malicious third-party code
 
# Client-side buffer overflow
 
# Failure to apply server-side controls
 
  
== Additional Considerations ==
+
Here is the original raw data: [[https://www.dropbox.com/sh/d143o6tbkdx4w4l/AAAQlpmnCpHCgiBqZkgXPSTKa?dl=0 Dropbox Data]]
  
# Abuse of client side paid resources
+
== Project Leads, Credit, and Contributions ==
# Failure to properly handle inbound SMS messages
+
 
# Failure to properly handle outbound SMS messages
+
* ''' [[Mobile_Top_Contributions|Mobile Top Ten Contributions Page ]] '''
# Malicious / Fake applications from appstore
+
 
# Ability of one application to view data or communicate with other applications
+
 
# Switching networks during a transaction
+
== How Did the List Get Made? ==
# Failure to Protecting Sensitive Data a rest
+
# We wanted to know what the community wanted in the next Mobile Top Ten list and what they thought about the last. We published a [http://bit.ly/1sihkkE survey] and shared the [https://docs.google.com/a/owasp.org/forms/d/1WMEbjVgXU4VkjHP5AcW934D9EI0_XQ5vmjb-Y5liMQY/viewanalytics results] with everyone.
# Failure to disable automation system keylogging functionality
+
# We issued a [https://www.owasp.org/index.php/File:MobileTopTen2015-CallForData.pdf Call for Data] and aggressively pursued many different vendors and consultants for raw data.
 +
# We had a huge response by vendors and consultants. We collected lots of data about the last years vulnerabilities from a number of different vendors and consultant. That raw data can be found [https://www.dropbox.com/sh/d143o6tbkdx4w4l/AAAQlpmnCpHCgiBqZkgXPSTKa?dl=0 here].
 +
# Over the coming months, we then analyzed the data. Lots of different contributors did their own analysis and compared results. [https://www.owasp.org/index.php/Mobile2015Commentary Here] is a sample of the color commentary on the data.
 +
# Ultimately, we agreed on the findings and published [https://www.owasp.org/images/9/96/OWASP_Mobile_Top_Ten_2015_-_Final_Synthesis.pdf key findings] from the data that we all agreed upon.
 +
# Next, we started coming up with a [https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-2015_Scratchpad consensus] of what we wanted in the next revision of the Mobile Top Ten.
 +
# Results were collected and a release candidate got released.
 +
# We examined the results from the release candidate and concluded that we achieved what we set out to do for 2016
 +
# We published the list officially and moved it from release to final stage
 +
 
 +
 
 +
== Archive ==
 +
* The list below is the OLD release candidate v1.0 of the OWASP Top 10 Mobile Risks. &nbsp;This list was initially released on September 23, 2011 at Appsec USA. &nbsp;
 +
** The original presentation can be found here:&nbsp;[http://www.slideshare.net/JackMannino/owasp-top-10-mobile-risks SLIDES]<br>
 +
** The corresponding video can be found here: [http://www.youtube.com/watch?v=GRvegLOrgs0 VIDEO]
 +
** [[Mobile_Top_10_2012|2011-12 Mobile Top Ten for archive purposes]]
 +
__NOTOC__

Latest revision as of 19:13, 13 February 2017


The Mobile Top Ten 2016

Following a 90-day review and publication of the release candidate, we determined that the release candidate was ready for final publication. The 2016 list has now been published and can be found here: OWASP Mobile Top Ten 2016

Feel free to visit the mailing list as well!

2015 Mobile Top Ten Analysis Results

Are you interested in what the data collection for the 2015 list looks like? Check out the final synthesis... Media:2015 Data Synthesis Results.pptx

We are fleshing out the new Mobile Top Ten at Projects/OWASP_Mobile_Security_Project_-2015_Scratchpad. Have a look.

Here is the original raw data: [Dropbox Data]

Project Leads, Credit, and Contributions


How Did the List Get Made?

  1. We wanted to know what the community wanted in the next Mobile Top Ten list and what they thought about the last. We published a survey and shared the results with everyone.
  2. We issued a Call for Data and aggressively pursued many different vendors and consultants for raw data.
  3. We had a huge response by vendors and consultants. We collected lots of data about the last years vulnerabilities from a number of different vendors and consultant. That raw data can be found here.
  4. Over the coming months, we then analyzed the data. Lots of different contributors did their own analysis and compared results. Here is a sample of the color commentary on the data.
  5. Ultimately, we agreed on the findings and published key findings from the data that we all agreed upon.
  6. Next, we started coming up with a consensus of what we wanted in the next revision of the Mobile Top Ten.
  7. Results were collected and a release candidate got released.
  8. We examined the results from the release candidate and concluded that we achieved what we set out to do for 2016
  9. We published the list officially and moved it from release to final stage


Archive

  • The list below is the OLD release candidate v1.0 of the OWASP Top 10 Mobile Risks.  This list was initially released on September 23, 2011 at Appsec USA.