The overall security level of mobile apps in the healthcare, financial and payments sectors is quite concerning, even for apps that have been vetted and approved by the government, according to a recent report revealed by Arxan.
By analyzing the security of over 126 mobile apps and gathering responses from 1,083 people from the US, UK, Germany and Japan, Arxan discovered a big difference between what users consider a secure app and how secure that app.
The study reveals that 90% of the tested apps were vulnerable to at least two of the OWASP Mobile Top 10 vulnerabilities. Of the health apps, 84% were approved by the US FDA (Food and Drug Administration) and 80% by the UK NHS ((National Health Service). In financial apps & mobile payment apps, 92% were also vulnerable to at least two of the OWASP Mobile Top 10 vulnerabilities.
Overall, 98% of applications lacked binary code protection, meaning they could easily be reverse engineered , and 84% of applications did not use encryption to transport and secure sensitive information.
Analyzing the healthcare and financial sectors, the numbers are alarming because they are worse for the financial sector, where criminals can use the lack of security to monitor and interfere with money transfers. For healthcare applications, the rates were 97% (lacking binary protection code) and 79% (lacking encryption), while for the financial sector they were 98% and 91% respectively.
Additionally, 50% of organizations surveyed said they have no budget allocated to strengthening mobile app security , which is why 46% said they expect to be hacked within the next six months.
Furthermore, the study also surprisingly found that Android banking apps are much more secure than their iOS counterparts. In numbers, 59% of Android apps were vulnerable to at least three OWASP Mobile Top 10 vulnerabilities, while 100% of iOS apps tested had at least three OWASP Mobile Top 10 vulnerabilities.
