Abstract:Mobile banking apps, belonging to the most security-critical app category, render massive and dynamic transactions susceptible to security risks. Given huge potential financial loss caused by vulnerabilities, existing research lacks a comprehensive empirical study on the security risks of global banking apps to provide useful insights and improve the security of banking apps. Since data-related weaknesses in banking apps are critical and may directly cause serious financial loss, this paper first revisits the state-of-the-art available tools and finds that they have limited capability in identifying data-related security weaknesses of banking apps. To complement the capability of existing tools in data-related weakness detection, we propose a three-phase automated security risk assessment system, named AUSERA, which leverages static program analysis techniques and sensitive keyword identification. By leveraging AUSERA, we collect 2,157 weaknesses in 693 real-world banking apps across 83 countries, which we use as a basis to conduct a comprehensive empirical study from different aspects, such as global distribution and weakness evolution during version updates. We find that apps owned by subsidiary banks are always less secure than or equivalent to those owned by parent banks. In addition, we also track the patching of weaknesses and receive much positive feedback from banking entities so as to improve the security of banking apps in practice. To date, we highlight that 21 banks have confirmed the weaknesses we reported. We also exchange insights with 7 banks, such as HSBC in UK and OCBC in Singapore, via in-person or online meetings to help them improve their apps. We hope that the insights developed in this paper will inform the communities about the gaps among multiple stakeholders, including banks, academic researchers, and third-party security companies.

SeMA: A Design Methodology for Building Secure Android Apps

SeMA: Extending and Analyzing Storyboards to Develop Secure Android Apps

A Developer-Centric Study Exploring Mobile Application Security Practices and Challenges

AppShell: Making Data Protection Practical for Lost or Stolen Android Devices

Security Smells in Android

Demystifying security and compatibility issues in Android Apps

Improving Mobile Application Security Via Bridging User Expectations and Application Behaviors

Dynamic Security Analysis on Android: A Systematic Literature Review

An Empirical Assessment of Security Risks of Global Android Banking Apps

Penetration Frameworks and Development Issues in Secure Mobile Application Development: A Systematic Literature Review

Automated, Dynamic Android App Vulnerability and Privacy Leak Analysis: Design Considerations, Required Components and Available Tools

Security Apps under the Looking Glass: An Empirical Analysis of Android Security Apps

System Call Dependence Graph Based Behavior Decomposition of Android Applications

From guidelines to practice: assessing Android app developer compliance with google's security recommendations

Security Evaluation of Companion Android Applications in IoT: The Case of Smart Security Devices

Evaluation of Security Solutions for Android Systems

Demystifying Hidden Sensitive Operations in Android apps

Security Analytics for Mobile Apps:Achievements and Challenges

Mobile App Security Trends and Topics: An Examination of Questions From Stack Overflow

Management system for secure mobile application development

Google Android: A State-of-the-Art Review of Security Mechanisms