Mobile Security · 2024 edition
OWASP Mobile Top 10 for iOS and Android apps, covering credential handling, supply chain, input validation, privacy controls, binary protection, and data storage.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 | Improper Credential Usage | Hardcoded credentials, insecure credential storage or transmission, and weak credential handling let attackers impersonate users or the app itself. | Details |
| 02 | Inadequate Supply Chain Security | Malicious or vulnerable third-party SDKs, compromised build pipelines, and unverified updates introduce code the developer never reviewed. | Details |
| 03 | Insecure Authentication/Authorization | Authentication or authorization decisions made on the client, weak session handling, and missing server-side checks allow account takeover and privilege escalation. | Details |
| 04 | Insufficient Input/Output Validation | Unvalidated data from users, deep links, intents, WebViews, or APIs leads to injection, path traversal, and code execution inside the app. | Details |
| 05 | Insecure Communication | Cleartext traffic, weak TLS configuration, and improper certificate validation expose data in transit to interception and tampering. | Details |
| 06 | Inadequate Privacy Controls | Apps collect, log, or share more personal data than needed, or leak it through logs, backups, clipboard, screenshots, and third-party SDKs. | Details |
| 07 | Insufficient Binary Protections | Unprotected binaries can be reverse engineered and tampered with to extract secrets and intellectual property, bypass checks, or redistribute modified apps. | Details |
| 08 | Security Misconfiguration | Debuggable builds, exported components, permissive file permissions, cleartext allowances, and insecure defaults expose app functionality and data. | Details |
| 09 | Insecure Data Storage | Sensitive data stored in plaintext in shared preferences, SQLite databases, external storage, caches, or logs is exposed to malware and device access. | Details |
| 10 | Insufficient Cryptography | Weak or deprecated algorithms, hardcoded keys, poor key management, and insecure randomness undermine encryption that protects data. | Details |
