1. Sioux Falls OWASP Jan-2018 Mobile Top 10

2. 25 Years in Software Development Banking, Logistics, Medical
About Me
Shannon Hofer
MetaBank
25 Years in Software Development
Banking, Logistics, Medical
@76foxtrot

3. M1 - Improper Platform Use
Easy to Exploit
Misuse or not using Keychain storage
Android intents
Follow platform guidelines

4. M2 - Insecure Data Storage
Easy to Exploit
Not using secure storage
Query String Sensitive Data

5. M3 - Insecure Communication
Easy to Exploit
Please use HTTPS/TLS
NFC/Bluetooth

6. M4 – Insecure Authentication
Easy to Exploit
Hide account info
Use Tokens(STS)
Multifactor authentication

7. M5 - Insufficient Cryptography
Easy to Exploit
Processes behind [en|de]cryption
Proper algorithm (AES..)

8. M6 - Insecure Authorization
Easy to Exploit
Server not checking authorization
Server Config and SSL
Device should not be the only thing checking

9. Dig deep into 3rd party libraries
M7 - Client Code Quality
Difficult to Exploit
Test inputs
Dig deep into 3rd party libraries

10. Decompiling and adding backdoors then sending back to the app stores
M8 - Code Tampering
Easy to Exploit
Decompiling and adding backdoors then sending back to the app stores
Add tamper proofing

11. M9 - Reverse Engineering
Easy to Exploit
Use obfuscators
Increase the logic complexity

12. M10 - Extraneous Functionality
Easy to Exploit
Remove developer debug functions
Code review process
Clean Coding

13. Resources
Mobile Top Top 10
NowSecure

14. Conclusion
Thank