Abstract:Mobile banking apps, belonging to the most security-critical app category, render massive and dynamic transactions susceptible to security risks. Given huge potential financial loss caused by vulnerabilities, existing research lacks a comprehensive empirical study on the security risks of global banking apps to provide useful insights and improve the security of banking apps. Since data-related weaknesses in banking apps are critical and may directly cause serious financial loss, this paper first revisits the state-of-the-art available tools and finds that they have limited capability in identifying data-related security weaknesses of banking apps. To complement the capability of existing tools in data-related weakness detection, we propose a three-phase automated security risk assessment system, named AUSERA, which leverages static program analysis techniques and sensitive keyword identification. By leveraging AUSERA, we collect 2,157 weaknesses in 693 real-world banking apps across 83 countries, which we use as a basis to conduct a comprehensive empirical study from different aspects, such as global distribution and weakness evolution during version updates. We find that apps owned by subsidiary banks are always less secure than or equivalent to those owned by parent banks. In addition, we also track the patching of weaknesses and receive much positive feedback from banking entities so as to improve the security of banking apps in practice. To date, we highlight that 21 banks have confirmed the weaknesses we reported. We also exchange insights with 7 banks, such as HSBC in UK and OCBC in Singapore, via in-person or online meetings to help them improve their apps. We hope that the insights developed in this paper will inform the communities about the gaps among multiple stakeholders, including banks, academic researchers, and third-party security companies.

Security Analysis of Third-Party In-App Payment in Mobile Applications

Defect Detection of Third Party Payment Processes in Android Applications

Detecting Repackaged Smartphone Applications in Third-Party Android Marketplaces

Payment-Guard: Detecting fraudulent in-app purchases in iOS system

AUSERA: Large-Scale Automated Security Risk Assessment of Global Mobile Banking Apps.

State of the Art: Secure Mobile Payment

The Dark Forest: Understanding Security Risks of Cross-Party Delegated Resources in Mobile App-in-App Ecosystems

Security Analysis of the Third-Party SDKs in the Android Ecosystem

An Empirical Assessment of Security Risks of Global Android Banking Apps

Cybersecurity Challenges in Mobile Payment Systems: A Case Study of Alipay in Chinese Cities

A Payment Model of Mobile Phone Based on Third-Party Security

Maginot Line: Assessing a New Cross-app Threat to PII-as-Factor Authentication in Chinese Mobile Apps

Research on Security of Mobile Payment for Commercial Bank

Research on the Risk and Management Countermeasures of Self-money Laundering in Third-party Payment—Taking WeChat Payment as an Example

Risk Analysis Of The Third-Party Payment In China

RESEARCH ON METHOD OF SECURITY COMPLIANCE DETECTION AND ANALYSIS FOR MOBILE PAYMENT SYSTEM

Security Apps under the Looking Glass: An Empirical Analysis of Android Security Apps

Are Mobile Banking Apps Secure? What Can Be Improved?

Analyzing Ground-Truth Data of Mobile Gambling Scams

Security Analytics for Mobile Apps:Achievements and Challenges

Research on the Problem of Mobile Payment Security