Only 5% of the apps had good defenses against runtime attacks manipulating the device environment, and only 4% were well-protected against man-in-the-middle (MitM) attacks at runtime, where attackers take over communications and in effect get “in the middle” between the two users. The second is during runtime, when the app is compromised at execution, by instrumenting the application, modifying the environment, or intercepting messages from the app to the backend via Man-in-the-Middle (MitM) attacks.' Credit: Approov’s Mobile Threat Lab ReportĪlong with exposing secrets, the scans also found two critical runtime attacks that could potentially be used to steal API keys at runtime. 'The first is static analysis, inspecting the source code and other components of the mobile app package for exposed secrets prior to runtime.

There are two main ways to steal secrets from a mobile app, according to the report. Miracco said they did the study in response to concerns stemming from high-profile API leak cases, such as the ones with Twitter last summer and T-Mobile in January. He pointed out that hackers have access to these same open-source tools to attack applications. Ted Miracco, chief executive officer of Approov, said he was surprised at how easy it was to obtain this information with the right tools. Researchers used open-source tools such as apk_api_key_extractor, gitLeaks, and Trufflehog to find sensitive data and ran Python scripts to analyze, classify and present the data.

'Even if keys and secrets cannot be easily reverse engineered from the mobile app code, hackers can get another opportunity to grab secrets at runtime by manipulating the app, the environment and/or the communication channel(s),' wrote researchers.Īpproov's research focused on the 'top 200' financial services apps in the United States, United Kingdom, France, and Germany from the Google Play App Store, which consisted a total of 650 discrete applications.

The study, released Thursday, found, of 92% of leaky apps nearly a quarter of those spilled 'extremely sensitive' data, such as authentication keys used for payments and monetary account transfers. Data was obtained via static analysis of apps and also as code was being executed on the mobile devices. Sensitive API data was obtained under optimum testing conditions and included researchers using a variety of open-source forensic and pen testing tools. The findings come from Approov’s Mobile Threat Lab, which reverse-engineered the mobile application code of financial service apps and was able to pry 'high-value secrets' from them. Ninety-two percent of 650 financial apps hosted on the Google Play App Store contain extractable data such as application programming interface (API) keys.

Google play app store update