Slashdot Mirror
Mobile Devs Making the Same Security Mistakes Web Devs Made in the Early 2000s (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: Mobile app developers are going through the same growing pains that the webdev scene has gone through in the 90s and 2000s when improper input validation led to many security incidents. But while mobile devs have learned to filter user input for dangerous strings, some of these devs have not learned their lesson very well.
In a research paper published earlier this year, Abner Mendoza and Guofei Gu, two academics from Texas A&M University, have highlighted the problem of current-day mobile apps that still include business logic (such as user input validation, user authentication, and authorization) inside the client-side component of their code, instead of its server-side section. This regretable situation leaves the users of these mobile applications vulnerable to simple HTTP request parameter injection attacks that could have been easily mitigated if an application's business logic would have been embedded inside its server-side component, where most of these operations belong.
In a research paper published earlier this year, Abner Mendoza and Guofei Gu, two academics from Texas A&M University, have highlighted the problem of current-day mobile apps that still include business logic (such as user input validation, user authentication, and authorization) inside the client-side component of their code, instead of its server-side section. This regretable situation leaves the users of these mobile applications vulnerable to simple HTTP request parameter injection attacks that could have been easily mitigated if an application's business logic would have been embedded inside its server-side component, where most of these operations belong.
For heavily used apps, leaving the validation client side can result in substantially lower hardware requirements on the server side.
Just because your average user is dumb doesn't mean the attackers are too.
How out-of-this-world do you have to be to include business logic on the client-side. Seriously... who in the hell is employing your stupid ass?
These are idiot developers.
There's nothing wrong with Client Side validation. It lets you prompt the user to correct their mistakes. Of course, this client side validation shouldn't be trusted when the data gets to the server-side. You need to check it on the server side also. Client Side verification has it's place in any good web application.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
How about apps that trust the client implicitly?
Yes I would like to change the passwords to everyone's account. Thank you server for honoring my request!
I don't think Web developers necessarily learned the lesson very well. Javascript-heavy (client-side JS) web apps with insecure RESTful backend also suffer from the same issues. I'm seeing a lot of those recently.
Hasn't Panera Bread just recently suffer from a similar issue?
It's funny how the media speaks of "software devs" like they're a cohesive body of professionals.
In fact it's largely a bunch of people straight out of a coding bootcamp in over their heads with titles like "senior full stack developer" who think they're 10x rockstars because they can code Hello World.
Managers love these folks because they work for peanuts + inflated job title. Need someone to cut corners to meet a deadline? Or to take some unethical business idea and build it into software? These are your guys.
Find me someone who's worked his ass off getting licensed to practice their profession who's willing to put their livelihood, license, and professional liability insurance premiums on the line to save a couple bucks here and there.
It's time for software to mature like other niches have- plumbers, electricians, structural engineering, for example. You DIY your projects around the house until you burn it down or the building inspector condemns it, and you should be able to do the same with your own computing hardware until you let the blue smoke out of it or it simply grinds to a halt under a malware infestation. But if folks are going to build apps for money they should be certified and accountable for ensuring their work meets reasonable standards.
The singularity AI will fix all that... BIGLY! Just dont try to buy a cake.. its against our beliefs to sell YOU anything.... FREEDUMBS 4 ALL!
License engineers have the power to tell there boss NO THAT IS UNSAFE.
Yet most engineers (outside of Civils, because it matters in that world) aren't licensed engineers, just people with engineering degrees.
people. Mobile apps are now the area inexperienced people will start writing their first public code. Before that it was web design and before that it was writing Windows desktop applications.
Some of those people will then grow up and most likely leave that field, just as the mobile app environments are as shitty as the web design environments or the Windows desktop application ones.
This presumes that web devs don't make these mistakes anymore.
They make this sort of mistake all the time. The difference is that any big, recognizable name that failed to fix this ultimately failed for one reason or another. Look at smaller sites or internal services at companies that are home grown, they are still chock full of this stuff.
XML is like violence. If it doesn't solve the problem, use more.
Newsflash, webdevs still make these same mistakes. Often times there is little or no distinction between a "web dev" and a "mobile dev" in reality.
More and more coders. Still the same (very small) number of people that can learn to code well. What do you expect? And no, coding well is not something everybody can learn. Might as well claim that anybody can be a PhD level Mathematician or a competent brain surgeon. Not so, not so in the least. And that utterly mistaken and completely unfounded belief is at the root of the problem.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This is absolutely true. The easiest way to see this is to connect your phone through a captive portal which injects content (such as ads) into web pages. Then watch as they start showing up in apps instead! And if you think this is just bottom-tier, b00by devs, think again. For the first two years or so of Instagram existing, this was an issue. I only discovered it on accident one time when using in-flight WiFi, and had the airline's advertising at the top of my Instagram feed inside of their Android app. Since the Facebook acquisition though, things have tightened down quite a bit, but this just goes to show that it doesn't matter what scale an app is, oversights and fuckery will happen.
Which one do the meta developers live in where a mobile device is always connected to the internet to make this distinction?
To be fair, even if input checking is being done client side (which should happen for consistency of experience and performance reasons), it should still be done server side.
You'll find clusters of PEs everywhere there are lives hanging on mature engineering. Aircraft, Automotive, Power, Navel as well as Civil and others I'm no doubt forgetting.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
You can't usually get a building permit without licensed engineers' stamps for structural, mechanical, and electrical. (Sometimes only an Architect's stamp is required, and for simpler jobs, maybe only a contractor's license.) However, the majority of the engineers doing the actual work are not licensed, but are rather working "under the direct supervision and responsibility" of the licensed engineer. This often means the person stamping the drawings has only a vague knowledge about the details of the design. Because of that, I've often said that a PE is a license to hire other people to do the work - but, of course, that's an exaggeration.
https://xkcd.com/327/
Fat, drunk, and stupid is no way to go through life, son.
People are dumb. What did you expect?
Stop forcing mobile users to download your "app" in order to use services and product (VENMO!).
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Having more regulation is required if we start to care about reliability of software systems. Currently, phone lines (landlines) have a government mandated quality of service, of 5x9s per year. That reliability is disappearing as VOIP is used more, since ISPs don't have any uptime guarantee.
The main blocker is the rise in pay that would occur due to less qualified workers, if professional licensing was required. The big tech companies have done everything to keep the wages as low as possible and creating fake licensing standards doesn't seem beyond their capabilities.
Particularly with mobile, it often makes sense to validate both places. Avoid a network call if you can.
If you've learned a lesson and don't write about it, and those lessons never get included in any curriculum or training. Then of course we're going to see people repeating the same mistakes. Don't assume that different industries automatically share information with each other.
Just like you don't see plumbers and electricians sharing information, you won't see much exchange between web developers, mobile developers, device driver developers, etc.
two academics from Texas A&M University, have highlighted the problem of current-day mobile apps that still include business logic (such as user input validation, user authentication, and authorization) inside the client-side component of their code, instead of its server-side section.
Maybe they want their app to be responsive and not spin waiting for the server to respond with "invalid input".
...For the trees.
For heavily used apps, leaving the validation client side can result in substantially lower hardware requirements on the server side.
There's a much more fundamental reason; Human Nature.
In general, the same type of people will approach the same type of problem in a similar way, including all the attempts at short-cutting, offloading, etc etc.
One can observe this phenomenon writ large in history, as people fall for the same ideological/political promises of Utopia again and again every few generations. A pioneering rock band of the 1960s called "The Who" had a famous song named "Won't Get Fooled Again" in which they summed this phenomenon up with the line; "Meet the new Boss, same as the old Boss". (BTW, if you've never heard The Who, do it. Do it now. Read comments later. Thanks optional but welcome :) )
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
And yet buildings fall down and airplanes fall apart mid-flight.
I'll compare Linus's competence with that of a PE any day. Neither are perfect, but some magic certificate wouldn't make Linus* any better at what he does.
* or any other quality software developer
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
But most companies have a few PEs around to do the necessary sign-offs. The other engineers just need to know who these people are.
Feels to me that it should be both...
Do client side validations to avoid invoking the server whenever the user sends something even if it's not valid, and do server side validation to sanitize the client side data, ensure it's not erroneous or hostile...
This was found out by that guy who found a pizza app that did client-side credit card validation.
This is why a 4-year program for software development beats a 4-week coding bootcamp - you learn about the history of the discipline, and some of the reasons why things are done certain ways. You have the time to learn the right way to do things, as opposed to the current trendy way.
Web developers are still doing a bad job. They fail to filter out unnecessary characters and reject perfectly reasonable input. Telephone numbers are a classic web dev fail. All of these should be valid:
(508) 999-1010
1-508-999-1010
5089991010
508-999-1010
and more.
Credit card numbers, dates and others are also major fail points.
it.
Surely that last one is the province of MDs?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Implementing secure protocols takes development time and knowledge. Time equals money: either more developers are needed or more development time (i.e. the shiny new product/version comes out the door later).
When eye candy sells better than some footnote about security in an advert, then guess which qualifications will be in demand from developers and which parts of a project will get more development resources allocated (time, qualified developers)?
OTOH the costs of even a major security blunder is a bit of bad press that'll soon be superseded by the next big story.
Now imagine you're the controller for the project, what would be your recommendations with respect for allocating resources in development or qualifications demanded when hiring new developers?
"By the way if anyone here is in advertising or marketing... kill yourself." -- Bill Hicks
So, developers are STILL making bad design choices - this is news somehow? LOL SMH
This is what happens when we have thousands of people becoming developers for the money, with no real passion for it...
You want quality code and good designs, hire people that love what they do, and give them time to do it. It's not at all mysterious.
Sorry.
Punchline: Whore: 'That's not my navel, that's my colostomy.'
Sorry, again. /Canadian
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Linux is not a RTOS. Don't put it in 'human life critical' applications. There is such a thing as a PE in 'software'.
No doubt Linus could build a RTOS, if he wasn't busy. But he hasn't yet. Likely wouldn't want to deal with the highly formal development process bullshit involved. Code checkin is like a square dance, no step of which involves 'cuss your partner'.
There are stripped down distros that make the RTOS claim. But 'kernel mode drivers'.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Most people make the mistake the other way round.
Naval gazing:. #Sitting on the dock of the bay ... watching the ships come in ... /#"
Confucius say, "Find worm in apple - bad. Find half a worm - worse."