March 26, 2015 By Christopher Hockings 4 min read

Using a personal mobile device for financial transactions exposes enterprises to risks that most cannot detect and prevent. This is mainly due to the inability to transform traditional access services to adapt to the mobile threat landscape while maintaining a delivery speed that can compete with their peers and is expected by their clients.

The transformation of application delivery approaches always introduces new vulnerabilities, but mobile transaction security demands a new perspective. Since app response time is a key indicator of mobile app competitiveness, design processes are pushing executable functions to the device itself, which exposes new exploit vectors to the attacker. Previous discussions have focused on protecting internal networks from malware hosted on enterprise mobile devices, so this article will consider the threat from the perspective of delivering consumer transactional apps.

Federal Reserve banks across the globe are simultaneously pushing for real-time payment processing. This pushes additional responsibilities on fraud teams to detect and prevent credit card and ATM fraud in near-real time. Remediation processes that banks relied on to recover fraudulent fund transfers in the past are being removed, so they must determine how best to detect fraud that is occurring at the time of the transaction. Such a mandate puts a premium on having intelligent fraud detection systems in place across the full breadth of consumer access services. Fraud detection is now required to adapt at Internet speed to threats present in traditional Internet and mobile access channels. With the accelerated use of mobile for online transactions, transaction processing through the Internet must be adapted and, in some cases, transformed.

Authenticity of the App

It is typical for security vendors to introduce mobile app protection as an extension of enterprise vulnerability scanning techniques. However, a larger percentage of functionality is embedded within the mobile app so it can interact directly with features of the device itself. Features such as geographic location, token storage mechanisms and fingerprint readers can be used within a mobile app. Such an approach has taken a level of protection that traditional Internet browsers provided, and this aspect is easily overlooked by service delivery teams. Leakage of the app functionality to a malicious individual reveals intelligence about how the app itself is designed and operates at runtime. This exposes the internal workings of the app code and enables an attacker to access, modify, rebuild and deploy without the transaction service being aware. Addressing this risk requires an approach that ensures that cannot be modified.

Trustworthiness of the Device

This mobile app code must support a broad range of devices, each running potentially different operating environments. This results in the app being exposed to a broad range of potential vulnerabilities across the support devices. Although Apple provides regular, consistent updates for the Apple device ecosystem, the same can’t be said for Google’s Android. This fragmentation creates an opportunity for attackers to target operating systems running on devices where known vulnerabilities remain unpatched. Even with Apple devices, it is well known that owners jailbreak their devices so they can run unverified app code or access traditionally locked-down device capabilities. Therefore, a device’s trustworthiness must always be questioned. The ability to assert the trustworthiness of a device is vital for addressing mobile transaction security concerns.

Identification of the User

Finally, there is the identification of the user. In the Internet age, the industry was unable to satisfy the need for risk-based authentication assurance policies that reflected a real-time transaction being performed. This is largely due to the lack of options provided by browser-based solutions. However, mobile device capabilities expose features that enable stronger authentication patterns that appease customer usage preferences. Binding a user through a known single password to a previously registered device is becoming a widely accepted baseline for low-value mobile transaction security policies. At the lowest level of assurance, the user of a registered app (without presenting the single password) can grant basic read-only access to financial data. This design approach has provided a significant improvement in user satisfaction for enterprises that have delivered graduated authenticated capabilities to enable swipe-for-balance and PIN-based authentication mechanisms for higher-level access.

Enterprises that provide mobile transaction security need protection mechanisms in place that consider these three key aspects. Before allowing access or transactional execution, authorization decision processes must be adequate enough to counter the threats represented not simply by one of these vectors, but the combination of all three. A risk-based methodology for acting upon unscrupulous behavior is required at runtime.

Mobile Transaction Security Offerings

The following are three well-defined cybersecurity domains that must be integrated together to provide a framework for implementing end-to-end mobile transaction security:

  • Access Management: A set of services that, among other capabilities, provide authentication and user context-based decisions for Web and RESTful Web services. When used with the aforementioned capabilities, products in this domain must provide the risk-based framework for authorizing users on devices using particular app code to perform transactions. It must provide this capability along with a set of industry-standard authentication mechanisms for authenticating users.
  • Fraud Protection: Fraud protection services ensure the status of the connecting device is known. This includes the identification of an individual device and attributes of the device, such as jailbroken, rooted, malware infection status, installation of rogue applications and the use of root-hiding tools. It provides quantitative, risk-based trustworthiness metrics that reflect the device’s operating state.
  • Application Security: Application protection wraps the app code to ensure executable code authenticity — i.e., the app being used on the device has not been tampered with.

When combined with secure data transit and flows, the question of whether a user should be able to perform a transaction using code running on a particular device can be made with confidence. Without one piece of the puzzle, enterprises simply can’t have the confidence to proceed without avoiding risk.

Read the Ponemon Study on the State of Mobile Application Insecurity

More from Application Security

Critically close to zero(day): Exploiting Microsoft Kernel streaming service

10 min read - Last month Microsoft patched a vulnerability in the Microsoft Kernel Streaming Server, a Windows kernel component used in the virtualization and sharing of camera devices. The vulnerability, CVE-2023-36802, allows a local attacker to escalate privileges to SYSTEM. This blog post details my process of exploring a new attack surface in the Windows kernel, finding a 0-day vulnerability, exploring an interesting bug class, and building a stable exploit. This post doesn’t require any specialized Windows kernel knowledge to follow along, though…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

Vulnerability management, its impact and threat modeling methodologies

7 min read - Vulnerability management is a security practice designed to avoid events that could potentially harm an organization. It is a regular ongoing process that identifies, assesses, and manages vulnerabilities across all the components of an IT ecosystem. Cybersecurity is one of the major priorities many organizations struggle to stay on top of. There is a huge increase in the number of cyberattacks carried out by cybercriminals to steal valuable information from businesses. Hence to encounter these attacks, organizations are now focusing…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today