Most mobile finance apps vulnerable to data breaches

77% of financial apps have at least one serious vulnerability that could lead to a data breach, an Intertrust report reveals.

This report comes at a time where finance mobile app usage has rapidly accelerated, with the number of user sessions in finance apps increasing by up to 49% over the first half of 2020. Over the same period, cyberattacks against financial institutions rose by 118%, according to VMware.

The study’s overall findings suggest that while the COVID-19 pandemic accelerated the world’s shift to digital financial channels and innovative technologies like mobile contactless payments, mobile financial application security is not keeping up.

Cryptographic issues pose one of the most pervasive and serious threats, with 88% of analyzed apps failing one or more cryptographic tests. This means the encryption used in these financial apps can be easily broken by cybercriminals, potentially exposing confidential payment and customer data and putting the application code at risk for analysis and tampering.

Other main findings

• One or more security flaws were found in every app tested
• 84% of Android apps and 70% of iOS apps have at least one critical or high severity vulnerability
• 81% of finance apps leak data
• 49% of payment apps are vulnerable to encryption key extraction
• Banking apps contain more vulnerabilities than any other type of finance app
• Nearly three-quarters of high severity threats could have been mitigated using application protection technologies such as code obfuscation, tampering detection, and white-box cryptography

The report analyzed over 150 mobile finance applications split evenly between iOS and Android and delivers insights from four major financial sectors: payments, banking, investment/trading, and lending. The apps investigated originated in the U.S., UK, EU, Southeast Asia, and India. They were analyzed using an array of static application security testing (SAST) and dynamic application security testing (DAST) techniques based on the OWASP (Open Web Application Security Project) mobile app security guidelines.

“As mobile finance apps increasingly enter people’s everyday lives, it’s vital to understand the security risks associated with these apps and the ways to help mitigate them,” said David Maher, CTO and EVP at Intertrust.

“Poor financial app security puts both financial organizations and their customers at risk, especially given the rise in cyberattacks over the course of the pandemic,” he added.