SECURITY VULNERABILITY ASSESSMENT OF MOBILE BANKING APPLICATIONS

Background to the Study

Past decade has witnessed substantial shift in financial service delivery from physical banking halls toward mobile-first channels driven by rising smartphone penetration expansion financial inclusion initiatives and operational cost advantages mobile channels offer financial institutions. In Nigeria Central Bank Nigeria cashless policy and financial inclusion strategy have further accelerated adoption mobile banking applications which now handle substantial share retail transaction volume including funds transfer bill payment airtime purchase and account management functions previously restricted to banking hall or ATM interaction. This expansion in mobile banking usage has been accompanied by corresponding expansion in attack surface available to malicious actors. Mobile banking application is particularly attractive target because it typically handles highly sensitive assets authentication credentials transaction PINs account balances and ability to initiate irreversible funds transfers while operating in inherently less controlled environment than bank internal server infrastructure: application executes on user-owned device unknown security posture transmits data over networks varying trustworthiness including public Wi-Fi and distributed through application stores where reverse engineering installed package technically straightforward for motivated attacker. Industry and academic security research bodies most notably Open Worldwide Application Security Project OWASP have documented recurring categories mobile application vulnerability including insecure data storage weak server-side controls insufficient transport layer protection and reliance on client-side security controls that can be bypassed on rooted or jailbroken device through structured references such as OWASP Mobile Top 10 and Mobile Application Security Verification Standard MASVS. Despite availability standards empirical assessments of deployed banking applications particularly in developing-economy contexts continue report presence well-documented avoidable vulnerability classes suggesting persistent gap between availability security guidance and consistent application in practice. This study conducts structured standards-aligned security vulnerability assessment mobile banking application functionality using combination static and dynamic analysis techniques applied within controlled ethically sound test environment with goal quantifying prevalence common vulnerability classes and producing actionable prioritised remediation guidance.

Statement of the Problem

·         Many mobile banking applications continue exhibit well-documented avoidable vulnerability classes e.g. insecure local storage weak transport security that structured testing would readily surface prior to deployment.

·         Security testing mobile banking applications frequently conducted informally or inconsistently without reference to standardised verification framework such as OWASP MASVS resulting in variable assessment coverage and quality.

·         There is limited published methodologically transparent empirical data on prevalence specific vulnerability classes across mobile banking-style applications in Nigerian/developing-economy context making it difficult for institutions to benchmark security posture.

·         Existing assessment approaches often rely exclusively on either static or dynamic analysis in isolation potentially missing vulnerability classes only detectable through complementary technique.

·         There is no consolidated prioritised remediation framework tailored to resource constraints typical small-to-mid-sized financial technology developers.

Aim and Objectives of the Study

Aim is to conduct structured security vulnerability assessment mobile banking application functionality and to produce prioritised standards-aligned remediation framework.

·         Review existing mobile application security standards testing methodologies and prior empirical assessments mobile banking application security.

·         Design and implement automated and semi-automated assessment toolkit integrating static analysis MobSF and dynamic analysis Drozer Burp Suite techniques guided by OWASP MASVS/MSTG framework.

·         Apply assessment toolkit to representative sample banking-style test applications within controlled ethically sound environment.

·         Quantify prevalence OWASP Mobile Top 10 vulnerability categories across assessed sample and apply weighted risk-scoring model to prioritise findings.

·         Compare detection coverage static analysis dynamic analysis and their combination.

·         Produce prioritised actionable set mitigation recommendations for mobile banking application developers.

·         Evaluate usability developed assessment toolkit among sample security practitioners/students.

Research Questions

1.      What vulnerability categories drawn from OWASP Mobile Top 10 are prevalent across assessed sample mobile banking-style applications?

2.      How does combined static-and-dynamic analysis approach compare to either technique in isolation in terms vulnerability detection coverage?

3.      What is relative risk priority identified vulnerabilities when assessed using weighted likelihood-impact risk-scoring model?

4.      What mitigation measures most effectively address highest-priority vulnerability classes identified?

5.      What is perceived usability developed assessment toolkit among security practitioners and students?

Significance of the Study

Significant to financial technology developers and financial institutions seeking strengthen security posture their mobile banking channels prior to and after deployment providing empirically grounded prioritised guidance rather than generic best-practice checklists. Significant to regulators and industry bodies concerned with systemic risk posed by insecure financial applications to consumers. Significant to academic community as methodologically transparent empirical contribution to comparatively limited body locally grounded mobile application security research. Finally significant to researcher as practical demonstration applied cybersecurity assessment methodology consistent with recognised industry standards.

Scope of the Study

Strictly limited for legal and ethical reasons to assessment of (a) purpose-built test application replicating common mobile banking functionality developed by researcher specifically for study and (b) publicly available deliberately vulnerable mobile banking-style benchmark applications distributed by OWASP and similar organisations specifically for security training and research purposes. At no point does study assess attempt to access or attempt to exploit any live production mobile banking application belonging to any real financial institution without authorisation; doing so would be both unlawful under Nigerian Cybercrimes Prohibition Prevention etc Act and violation standard responsible-disclosure and research ethics norms. Findings should therefore be interpreted as indicative vulnerability classes commonly found in mobile banking-style applications generally rather than assessment of any specific named institution live application.

Limitations of the Study

·         Findings based on purpose-built test application and publicly available benchmark applications rather than live production banking applications for legal and ethical reasons; real-world prevalence rates may differ.

·         Assessment sample limited to Android-based applications; iOS-specific vulnerability classes discussed conceptually but not empirically assessed owing to tooling and device access constraints.

·         Dynamic analysis conducted within emulator/controlled device environment which may not perfectly replicate all behaviours observable on physical production devices.

·         Time constraints limited assessment to twelve OWASP Mobile Top 10-derived vulnerability categories rather than exhaustive enumeration all possible mobile vulnerability classes.

Operational Definition of Terms

·         Static Analysis: Examination application source code bytecode or compiled package without executing it to identify potential vulnerabilities.

·         Dynamic Analysis: Examination application behaviour during execution typically involving runtime instrumentation and network traffic interception.

·         MASVS: OWASP Mobile Application Security Verification Standard framework defining security requirements for mobile applications.

·         Certificate Pinning: Security technique that restricts application to trusting only specific pre-defined TLS certificates mitigating man-in-the-middle attacks.

·         Insecure Data Storage: Storage sensitive data credentials tokens PII in unencrypted or weakly protected form on-device.

·         Risk Score: Numerical value derived from combination vulnerability likelihood exploitation and potential impact used to prioritise remediation.

·         Root/Jailbreak Detection: Application logic intended to detect and respond to execution on device whose operating system security restrictions have been bypassed.

·         Reverse Engineering: Process analysing compiled application package to reconstruct its logic typically via decompilation or disassembly.

Short Conclusion

Total 12 vulnerability categories drawn from OWASP Mobile Top 10 assessed across sample applications including insecure data storage weak cryptography insecure communication insufficient certificate pinning improper platform usage. Results showed 8 of 12 vulnerability categories were present in at least one assessed sample applications with insecure local data storage unencrypted shared preferences and SQLite databases and absent or misconfigured SSL/TLS certificate pinning identified as most prevalent weaknesses appearing in 75% and 62.5% of assessed samples respectively. Weighted risk-scoring model incorporating exploitability and impact dimensions consistent with OWASP Risk Rating Methodology applied to prioritise findings and set mitigation recommendations including mandatory use Android Keystore-backed encryption certificate pinning root/jailbreak detection and secure coding checklists compiled into practical remediation guideline. Concludes mobile banking applications even where developed by financially resourced institutions commonly exhibit avoidable security weaknesses that structured standards-aligned assessment methodology can systematically surface and recommends financial institutions incorporate MASVS-aligned testing into software development lifecycle rather than relying solely on post-deployment penetration testing.

10 SEO-Friendly FAQs

1. What methodology used for assessment?

Hybrid methodology combining structured static and dynamic Mobile Application Security Testing MAST process guided by OWASP MASVS and Mobile Security Testing Guide MSTG with Design Science Research approach developing accompanying automated assessment toolkit integrating MobSF Drozer Burp Suite.

2. What applications were assessed ethically?

Strictly limited for legal ethical reasons to purpose-built test application replicating common mobile banking functionality login balance enquiry funds transfer PIN/biometric authentication developed researcher and publicly available deliberately-vulnerable banking-style training applications OWASP mobile testing benchmark applications providing controlled ethically sound environment; no live production banking applications assessed without authorisation unlawful under Nigerian Cybercrimes Act.

3. What tools for static and dynamic analysis?

Static analysis performed using MobSF Mobile Security Framework automates pipeline decompiles APK AAB with JADX parses AndroidManifest.xml flags issues mapped to OWASP MASVS Mobile Top 10 and manual manifest code review; dynamic analysis performed using Drozer and Burp Suite controlled proxy emulator environment runtime instrumentation network traffic interception.

4. What vulnerability categories assessed?

Total 12 vulnerability categories drawn from OWASP Mobile Top 10 2024 including improper credential usage inadequate supply chain insecure authentication insufficient input output validation insecure communication inadequate privacy controls insufficient binary protections security misconfiguration insecure data storage insufficient cryptography including insecure local data storage weak cryptography insecure communication insufficient certificate pinning improper platform usage.

5. What were most prevalent weaknesses?

Results 8 of 12 vulnerability categories present at least one assessed sample; insecure local data storage unencrypted shared preferences and SQLite databases and absent or misconfigured SSL/TLS certificate pinning most prevalent appearing 75% and 62.5% of assessed samples respectively indicating storing tokens AsyncStorage UserDefaults Keychain Keystore and no certificate pinning HTTP traffic.

6. How was risk prioritised?

Weighted risk-scoring model incorporating exploitability and impact dimensions consistent with OWASP Risk Rating Methodology applied to prioritise findings considering likelihood exploitation and potential impact deriving risk score numerical value used to prioritise remediation.

7. What mitigation recommendations?

Mandatory use Android Keystore-backed encryption EncryptedSharedPreferences never store sensitive data SharedPreferences UserDefaults, certificate pinning Network Security Config OkHttp TrustKit restricts trusting only specific pre-defined TLS certificates mitigating man-in-the-middle, root/jailbreak detection application logic detecting responding execution on device whose OS security restrictions bypassed, secure coding checklists, biometric auth rules BiometricPrompt OAuth2 PKCE.

8. How does static vs dynamic coverage compare?

Combined static and dynamic analysis comparison; static analysis examines code resources without running catching pattern-based structural weaknesses early; dynamic examines behaviour during execution runtime instrumentation; combination detects complementary vulnerability classes only detectable through complementary technique missing when either in isolation.

9. Is MASVS guarantee absolute security?

MASVS designed evaluate security mobile apps analysed statically obtaining app package dynamically running on potentially compromised device; while OWASP MASVS invaluable tool enhancing security mobile applications it cannot guarantee absolute security should be used as baseline security requirements additional security measures implemented as appropriate address specific risks threats mobile app.

10. Where to find similar cybersecurity project topics?

Explore security vulnerability assessment mobile banking topics on ScholarNestHub cybersecurity collection and OWASP Mobile Application Security Verification Standard documentation and Indonesian Android mobile banking apps assessment using MobSF OWASP MASVS Level 2.