The IT Nerd

Approov, the leader in mobile security, today revealed new data indicating that watches, wearables and new devices are now the weakest link in the mobile app threat landscape.

Key findings include:

• Watches and other wearables now communicate directly with backend APIs and services.
• An Apple Watch “zero-day” vulnerability was uncovered in September 2023.
• Unless protected, watches and wearables will become a rich attack vector for hackers.
• Approov extends its mobile RASP to Watch OS to prevent exploitation of any new zero-day vulnerabilities.

The findings were released in today’s Approov blog “Approov Addresses Apple Watch Security Issues” at this link: https://approov.io/blog/apple-watch-security-issues

Apple and MIT recently published a study indicating that 2.6 billion personal records were exposed through data breaches over the last two years. These findings underscore the need for protecting data in the cloud through mobile attestations and improved API security.

Approov, a trailblazer in mobile app and API security, addresses this threat directly with Release 3.2. The release introduces groundbreaking features, including the first commercially available App Attestation Solution for Apple WatchOS to provide API Protection against emerging threats.

The release also includes Harmony OS support and deployment of extended global Points of Presence (PoPs), and improved ease of deployment and administration.

Approov’s Runtime Application Self Protection (RASP) defenses are also strengthened by extending threat detections to include the latest versions of tools used by hackers to attack apps and APIs.

The danger is real: In September, Citizen Lab found an actively exploited zero-click Apple vulnerability which was used to deliver NSO Group’s Pegasus mercenary spyware. Apple acknowledged the threat to all their devices, issuing a specific WatchOS Security briefing (https://support.apple.com/en-mide/106360) on November 9 concerning a vulnerability in Apple Wallet on WatchOS. Apple quickly released a fix but acknowledged that “A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited”.

Approov now extends all the protections available on mobile apps to WatchOS. Approov support of WatchOS allows direct registration of WatchOS apps and ensures API protection against malicious traffic that is communicating directly from the watch to the cloud. WatchOS support is added to the existing support for Android Wearable Devices (which has been available since Version 3.0)

Approov Adds Huawei HarmonyOS Support: A Global Imperative

As a widely adopted operating system in regions such as China, India, the Middle East, and Africa, HarmonyOS plays a crucial role in the global mobile ecosystem. Recognizing the prevalence of this platform, Approov now ensures that mobile applications operating on Huawei devices are seamlessly integrated into our attestation services.

Approov attestation services traditionally supported Android and iOS devices, but the inclusion of Huawei HarmonyOS significantly broadens our platform coverage. This expansion is vital to offering a truly global solution, as any unattested mobile application poses a potential risk to API security, regardless of its geographical origin.

In collaboration with Cylab-Africa, Approov reinforces its commitment to a global solution for mobile app security. Version 3.2 extends support for Huawei app store deployments, catering to developers worldwide.

Enhanced High-Performance Worldwide Coverage

Approov expands its global network with new Points of Presence in São Paulo, Brazil and Singapore. These additions, coupled with existing points of presence (PoPs) in Europe (Dublin) and North America (California), create a worldwide low-latency mobile attestation network.

This move bolsters Approov’s commitment to achieving new levels of security by mitigating bot attacks, Man-in-the-Middle (MitM) attacks, account takeover (ATO) and other threats to mobile APIs, thus ensuring optimal performance and reducing fraud and data breaches.

New Threats are Addressed

The new release also boosts Approov’s RASP feature set to include new countermeasures against emerging and evolving threats. This includes significant hardening improvements to the SDK, including static and dynamic anti-tamper measures. Additionally, Approov’s ThreatLabs have developed further Android based detections for DobbyHook, Magisk, Zygisk, and Zygisk-Frida to fortify defenses against these advanced hacker tools. These changes augment the comprehensive suite of detections that are already implemented. In addition, the dynamic security-policy update facility will be used to improve the detection capabilities of existing deployed apps that currently use Approov’s previous SDKs.

Increased Ease of Use for DevOps/Developers

Approov continues to focus on easing the security burden for developers, DevOps and DevSecOps teams. New features simplify app registration and management, providing an automated and streamlined integration experience. The elimination of the need for individual app registrations and the introduction of tools for managing different app versions reduce complexity. Approov also enhances the registration of developer devices for testing, ensuring a secure and efficient device farm testing process.

Approov Mobile App and API Security Software Release 3.2 reaffirms the Company’s commitment to continued innovation in order to ensure there are no weak links for its customers.

Upgrades to Approov Version 3.2 will be included as part of Approov’s Software-as-a-Service Mobile Security platform. New customers can embrace the future of mobile app and API security by starting a free 30-day trial by registering at Approov.io. 

End-to-end mobile security provider Approov today released a report showing that 95 percent of the most popular African banking and financial services apps contain easy-to-extract secrets, which could be used in scripts and bots to attack application programming interfaces (APIs) and steal data, devastating consumers and the institutions they trust.

The research was conducted by a team from the CyLab-Africa and Upanzi Open Digital Technologies Network initiatives in and sponsored by Approov: 224 financial Android applications were selected from countries in North, Central, Eastern, Western and Southern Africa, and were downloaded and investigated.

CyLab-Africa, located in Kigali, Rwanda, is a collaboration between Carnegie Mellon University’s CyLab Security and Privacy Institute and Carnegie Mellon University Africa. Upanzi is an Africa-based network of research labs that focuses on creating, testing, innovating and assisting in implementing digital technologies at scale, such as identity, payments, cybersecurity, cloud computing, data governance, artificial intelligence and machine learning, and influencing technology policy recommendations to support the digital transformation of low- and middle-income countries (LMICs).

The study draws comparisons between other regions and Africa, pinpointing trends, commonalities, and disparities pertaining to the exposure of secret keys in a mobile application’s binary package. 

Notably, 18% of the apps investigated revealed high severity secrets. A high severity classification was used for vulnerabilities that could potentially lead to unauthorized access, data breaches, and compromised user privacy. These apps together constitute a total of 272 million downloads across the continent with 72% of the apps revealing medium severity secrets that encompass sensitive data. If exposed, they could potentially compromise the confidentiality of user data and application functionality.  (Key findings are listed below).

The World Economic Forum analyzed the enormous importance of mobile financial apps across Africa, in its March 18, 2022 briefing:  Mobile payment in Africa is more popular than you may think – here’s why. It’s worth remembering that landlines are comparatively scarce and there are over 650 Million users of mobile devices – more than in either the USA or EU. 

The keys found in the reverse engineered Android Application Packages (APKs) include: 

• encryption keys for securing sensitive data 
• authentication keys for accessing services 
• signing keys for verifying data authenticity
• database credentials 
• OAuth client secrets 
• push notification keys 
• code push keys 
• payment gateway secrets 
• encryption initialization vectors 
• license keys 
• sensitive configuration setting 

Key findings: 

• 95% of fintech apps across Africa immediately expose valuable, exploitable secrets.
• Approximately 272 million users have downloaded apps that inadvertently reveal sensitive, high-risk secret keys. 
• Crypto was the most exposed type of app, with 33% of crypto apps found to expose high severity secrets. 
• Apps deployed in West Africa were the most exposed in terms of high severity secret exposure and Southern Africa the least: 20% of apps in West Africa exposed such secrets versus only 6% in Southern Africa.
• Google Cloud API keys were identified in 86% of the examined applications. Such exposure can lead directly to accounts being compromised. 
• Approximately 15.3% of the apps exposed various authentication tokens, including Facebook authentication tokens.

The full report can be downloaded here.

End-to-end mobile app security provider Approov today launched a comprehensive global partner program dedicated to ensuring qualified business, reseller and technology leaders have access to its proven mobile security and comprehensive support, building on the large a number of existing Approov technology partnerships. 

Qualified participants can sell, integrate and support cutting-edge mobile security solutions from Approov in order to safeguard mobile apps, a critical element for almost all business transactions today. Approov partners work together with Approov technology experts to deliver complete solutions to their customers. Partners can help their customers fortify their applications against threats and vulnerabilities, ensuring the highest level of security for their users. 

Partners can deliver state-of-the-art mobile app security addressing customer needs, add value to their business and open new revenue opportunities as they ensure security for mobile apps in an increasingly interconnected world. Approov offers a full range of assistance and tools to partners as well as access to a rich ecosystem of experts.

Qualified participants can be consultants, managed security service providers (MSSPs), resellers or technologists with a focus on safeguarding mobile security. More information about the partner program, qualification criteria and registration information are available at the Approov partner portal.

New Partners Promotion: For a limited time, newly registered and qualified partners will be entitled to five complimentary mobile app security assessments to offer to their customers, delivered by Approov experts in collaboration with the partner. Registration by September 30, 2023, is required for this promotion.  

Approov, the end-to-end mobile app security provider, today added Genopets, developer of a free-to-play mobile pet care game, to its growing user base while stopping cheaters from spoiling the fun.

The Genopets mobile pet care game lets players care for their digital pet while caring for themselves. The game uses step data from a player’s mobile device to power their journey in the game as they explore, battle, and evolve their Genopets — earning crypto while they play.

Genopets’ innovative and popular game attracted hackers and cheaters trying to use its APIs to manipulate data on the backend to gain unfair advantage of the game, spoiling the fun for players who played by the rules.

It selected Approov to protect its API resources from abuse and ensure that every request to its backend originated from its authentic app and an authentic mobile device.

Genopets users appreciate that Genopets take security seriously – both to protect users’ personal information at all times and to protect game fairness.

Approov, the end-to-end mobile app security provider, today named Pearce Erensel vice president of sales, reporting to Approov’s CEO Ted Miracco.

Erensel will have responsibility for Approov’s global sales and support. His focus will be on increasing Approov’s footprint in the mobile app security market by leading a professional sales and business development organization and driving customer-facing processes.

Pearce Erensel is an experienced sales and business development executive noted for meeting or exceeding revenue targets. Most recently, he was employed by Zimperium in its London office after serving as an account executive for whiteCryption, a company acquired by Zimperium. At Zimperium, he was a product expert for its mobile app protection suite working alongside EMEA account executives and training application engineers. At Intertrust Technologies Corporation, a software technology company specializing in trusted distributed computing, Erensel worked as a business development manager and account executive. He began his career in New York City working as a corporate sales trainer for advertising services firm First Reaction Inc.

Erensel is a graduate of Dickinson College in Pennsylvania with a Bachelor of Arts degree in Environmental Studies. He holds a Master of Arts degree in Global Policy from the University of Maine School of Policy and International Affairs (SPIA) in Orono, Maine.

Ninety two percent of the most popular banking and financial services apps on the Google Play Store contain easy-to-extract secrets (such as API keys), which could be used by cyber attackers in scripts and bots to steal data, devastating consumers and the institutions they trust.

The study “Mobile App Security Report – Exposing the Security Vulnerabilities of Top Finance Apps” summarizes the work of the Approov Mobile Threat Lab. The team downloaded, decoded and scanned the top 200 financial services apps in the U.S., U.K., France and Germany, investigating a total of 650 unique apps. 

Only 5% of the apps examined had good defenses against runtime attacks manipulating the device environment and only 4% were well protected against Man-in-the-Middle (MitM) attacks at run-time. As well as immediately exposing secrets, scans also indicated two critical runtime attack surfaces that could be used to steal API keys at runtime.

Other findings: 

• None of the 650 apps “ticked all the boxes” in terms of the three attack surfaces investigated. All failed in at least one category.
• Only four apps had runtime protection against channel MitM attacks and “man-in-the-device.” All were payment and transfer apps and none with such protections were in the U.S.
• In general, apps deployed in Europe were better protected than apps available only in the U.S., for immediate secret exposure and runtime protections. 
• Crypto apps were more likely to leak sensitive secrets as 36% immediately offered highly sensitive secrets when scanned. 
• 18% of personal finance apps leaked sensitive information, possibly because they are less dependent on sensitive APIs.
• For Man-in-the-Device attacks, traditional banks’ mobile apps are twice as likely to be well protected over other sectors reflecting the use of packers and protectors to protect against run-time manipulation.   

The report can be found here.

UPDATE: Rajiv Pimplaskar, CEO of Dispersive Holdings, Inc. had this comment:

    “Cloud security is always constant battle between convenient access and secure access. In the examples of the reports, the wide majority of the applications contained “pre-baked” API keys that provided access to certain “secured” public services just by the presence of the API key. Once compromised, the security of the API is completely out the window. 

   “API keys for accessing *any* public service should not last indefinitely and they should never come directly with a mobile or enterprise application install. The most secure way is requiring that the API keys be received after proper authentication (and most likely Multi Factor Authentication, MFA). In today’s day and age, MFA is not difficult to set up and while it isn’t perfect, it provides meaningful resistance to most hackers and malicious actors looking for low hanging fruit. 

   “Once the API key is obtained, accessing the service is still a potential waving flag for malicious actors. The transport mechanisms and source/destination addresses can become immediate targets. 

   “That’s why stealth networking and solutions can be truly innovative. Obfuscating and encrypting and protecting data in transit can provide the enhanced security from mobile endpoint all the way to cloud. Additionally, with a stealth networking solution, the ability for a malicious actor to set up a MITM attack is severely hindered. By removing “known” open endpoints, malicious actors can’t easily setup the MITM to try to intercept and capture/modify packets.”

Approov and Osterman Research today issued “The State of Mobile App Security in 2022”. Key findings include:

• 75% of companies say mobile apps are now “essential” or “absolutely core” to their success, up from 25% two years ago.
• 75% Would Face Substantial Consequences from a Successful Attack on Their Mobile App: An attack against APIs that rendered a mobile app non-functional would have a significant effect on 45 percent of businesses and a major impact on an additional 30 percent.
• 78% Have Low Confidence in Mitigation Against Specific Threats: Seventy-eight percent of respondents are not highly confident that their organizations have the appropriate level of security defenses and protections in place to protect against specific threats posed by mobile apps.
• Poor Visibility into Security Threats Against Mobile Apps:
  • 60% lack visibility into credit fraud attempts
  • 59 % lack visibility into the creation of fake accounts
  • 56% lack visibility into data stolen from PIs by scripts
  • 54 % cannot detect the use of stolen API keys being used to mimic genuine requests
  • 53% percent lack visibility into credential stuffing attacks
  • 51% lack visibility into secrets exposed on mobile platforms,
  • 50 % cannot detect access by cloned, fake or tampered apps.

• Third-Party APIs Create Pathways for Threat Actors:
  • On average, mobile apps depend on more than 30 third-party APIs, and half of the mobile developers surveyed are still storing API keys in the app code – a massive attack surface for bad actors to exploit.
  • 42% of organizations don’t require third-party developers to attest to following required standards, and 38% do not pen test the security of third-party code.

Aimei Wei, CTO and Cofounder of Stellar Cyber had this comment:

     “Mobile apps are certainly a growing attack surface rapidly. Mobile app developers need to follow practices such as not hard code secrets or storing API keys in a secure place. It will help to reduce the attack surface. On the other hand, having visibility of runtime threats against mobile apps and APIs is critical, having a detection and response system that can provide visibility and detect attacks in real time will help to provide the overall coverage and fill the gap.”

Edward Roberts, VP of Marketing, Neosec added this:

     “APIs are a very important part of mobile apps and their adoption is widespread. But APIs in mobile apps are focused on business to consumer API behavior and usage. There is another large attack surface of business-to-business APIs that connect commerce globally which are unfortunately largely unprotected. The vulnerabilities and potential abuse of these b2b APIs is increasingly concerning to security professionals worried about the risk exposure of their organization.”

Hopefully mobile app developers get the message and improve their code so that they are not threats. That helps them and it helps the rest of us.

Approov, creators of advanced mobile app and API shielding solutions, today introduced Approov Runtime Secrets Protection, enabling comprehensive protection of the API credentials and secrets that are typically targeted by threat actors for malicious exploitation.

Recent breaches have highlighted the risk of stolen keys and secrets being exploited by hackers. It is clear that such secrets are not being effectively protected at rest and in transit, resulting in bad actors acquiring them and exploiting them to access APIs and applications.

The wide use of third-party APIs by mobile apps adds another dimension to the problem. Mobile app developers can suffer both financial losses and brand reputation damage if they are seen to be the cause of 3rd party app breaches or service disruptions caused by Distributed Denial of Service (DDoS) attacks using stolen secrets.

Recent research from Osterman Research illustrates the extent of the issue:

“Upcoming Osterman findings show that mobile apps depend on average on more than 30 third-party APIs, and that half of the mobile developers we surveyed are still storing API keys in the app code,” Michael Sampson, senior analyst at Osterman Research, said. “These two things together constitute a massive attack surface for bad actors to exploit. And third-party API threats against mobile apps aren’t as well understood by companies as they should be. The new functionality from Approov allows API keys to be managed and updated dynamically and ensures they are never extractable from the app. This is a major step forward in protecting APIs from abuse.”

Developers have frequently been urged not to store hard coded keys in a mobile app or device, but as the research shows this “best-practice” is not widespread, since up to now, there has been no easy way to conveniently store such secrets safely outside the app code.

Introducing Approov Runtime Secrets Protection: Just in Time Keys Secrets That Thwart Mobile API Attacks

This is why Approov is releasing new functionality in Approov 3.0 which addresses this issue by making management of API keys and other secrets easy and secure, at rest, or in transit.

Approov Runtime Secrets Protection manages and protects all the secrets a mobile app uses. The Approov cloud service delivers secrets “just-in-time” to the app only at the moment they are required to make an API call, and only when the app and its runtime environment has passed attestation. This ensures that sensitive API secrets are not being continuously stored or delivered to unsafe places, such as fake apps or into malicious hands.

All secrets are stored by the Approov cloud service and are easy to manage dynamically. If changes to these are needed, they are easily and immediately changed across all deployed apps, preventing abuse.

This approach marks a major improvement over keys that are hard coded in the app itself, because should those keys be “leaked” the app must be updated with an entirely new version – a process which is complex and time-consuming, and involves juggling new and old keys during the time it takes for the installed base to be transferred to the new version.

Upcoming Webinar

Join the live webinar from Approov on June 9th “Best Practices for Secure Access of 3rd Party APIs from Mobile Apps” which will discuss the reputational and financial risks associated with API use and how to mitigate those risks. Sign up here.

Pricing and Availability

The pricing of the Approov solution is designed to be completely aligned with your business growth, based on the number of genuine active apps in a monthly billing period. Approov 3.0 is available now.