Mobile Security · 2024 edition
OWASP Mobile Top 10 for iOS and Android apps, covering credential handling, supply chain, input validation, privacy controls, binary protection, and data storage.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 | Improper Platform Usage | Misuse of platform features or failure to apply platform security controls enables attacks. | Details |
| 02 | Insecure Data Storage | Sensitive data stored insecurely on the device can be accessed by other apps or through physical access. | Details |
| 03 | Insecure Communication | Data transmitted between the app and backend without proper encryption is vulnerable to interception. | Details |
| 04 | Insecure Authentication | Weak authentication mechanisms allow unauthorized access to mobile apps and backend services. | Details |
| 05 | Insufficient Cryptography | Weak or custom cryptographic implementations fail to protect sensitive data adequately. | Details |
| 06 | Insecure Authorization | Missing or weak authorization checks allow users to access data or functions beyond their permissions. | Details |
| 07 | Client Code Quality | Poor coding practices in mobile apps introduce vulnerabilities like buffer overflows and injection flaws. | Details |
| 08 | Code Tampering | Attackers can modify app binaries to bypass security controls, inject malicious code, or extract secrets. | Details |
| 09 | Reverse Engineering | Insufficient protections allow attackers to analyze app internals, extract secrets, and understand business logic. | Details |
| 10 | Extraneous Functionality | Hidden or undocumented features like debug interfaces and test endpoints create unintended attack vectors. | Details |
