Application Security Report Calls Out Problems With Mobile, IoT Devices and DevOps

Vulnerabilities in mobile backends, web interfaces to the Internet of Things (IoT) and negligent DevOps practitioners are among the fastest growing application security threats, according to a report released at the InfoSecurity Europe conference in London this week.

What’s the Problem?

Research from High-Tech Bridge, a Swiss company that also operates in the U.S., said 83 percent of web service and application programming interfaces (APIs) used in apps for retail, banking and other markets could fall prey to XML or SQL injections.

The report, which is based on data from publicly available sources and the application security testing platform ImmuniWeb, cited problems such as poor encryption and admin credentials that can’t be modified in 98 percent of IoT devices. Additionally, while DevOps is a popular way to create applications quickly, the report said two-thirds of companies using this methodology had at least one high-risk vulnerability affecting an external application.

Addressing Application Security Threats

Many companies have tried to mitigate these kinds of application security risks by offering cash rewards to white-hat hackers who try to discover potential bugs or vulnerabilities. However, Help Net Security noted that the High-Tech Bridge report showed these bug bounty programs aren’t proving very effective: At least two major vulnerability were undiscovered by these individuals in 9 out of 10 bug bounty programs that had been running for a year or longer.

There’s no question enterprises need more than bug bounties to keep up with application security problems. For example, attacks based on cross-site scripting (XSS) were also called out as one of the most common vulnerabilities in the report, and they are among the most difficult to catch. Just a few weeks ago, for instance, Threatpost explained how Verizon had to patch an XXS vulnerability discovered in its messaging client.

Not everything in the application security report was negative. Tech Republic highlighted one finding from High-Tech Bridge, which explained that vast majority of mobile app code — as much as 95 percent — is not at risk of major breaches from cyberattackers. Despite this, the report also said companies should be working harder to protect web servers, improve web application firewalls and harden HTTPS encryption.

To learn more about this topic, download our complimentary Ponemon Institute “State of Mobile and IoT Security” study.

Shane Schick

Writer & Editor

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Unveiling the latest banking trojan threats in LATAM

9 min read - This post was made possible through the research contributions of Amir Gendler.In our most recent research in the Latin American (LATAM) region, we at IBM Security Lab have observed a surge in campaigns linked with malicious Chrome extensions. These campaigns primarily target Latin America, with a particular emphasis on its financial institutions.In this blog post, we’ll shed light on the group responsible for disseminating this campaign. We’ll delve into the method of web injects and Man in the Browser, and…

Crisis communication: What NOT to do

4 min read - Read the 1st blog in this series, Cybersecurity crisis communication: What to doWhen an organization experiences a cyberattack, tensions are high, customers are concerned and the business is typically not operating at full capacity. Every move you make at this point makes a difference to your company’s future, and even a seemingly small mistake can cause permanent reputational damage.Because of the stress and many moving parts that are involved, businesses often fall short when it comes to communication in a crisis.…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

What’s the Problem?

Addressing Application Security Threats

More from

Hive0137 and AI-supplemented malware distribution

Unveiling the latest banking trojan threats in LATAM

Crisis communication: What NOT to do

Topic updates