OWASP Mobile Top 10 - M3: Insecure Authentication/Authorization

Threat Agents & Attack Vectors

Attackers exploit weak authentication and authorization through automated tools, malware, or botnets. They may bypass authentication or escalate privileges via direct server requests.

Security Weakness:

• Common & Detectable: Attackers exploit offline authentication flaws and privilege escalation.
• Risk Factors: Storing passwords locally, weak PINs, reliance on client-side checks, and insecure API endpoints.

Impacts:

• Technical: Unauthorized access, compromised data, and lack of user tracking.
• Business: Reputation damage, data breaches, and fraud.

Prevention Measures:

• Authentication: Use server-side authentication, avoid local password storage, and implement strong password policies.
• Authorization: Validate roles server-side, avoid transmitting user permissions, and enforce integrity checks.

Example Attacks:

1. Hidden Service Requests: Backend fails to verify users, allowing anonymous service execution.
2. Interface Reliance: Low-privilege users access admin functions due to missing server-side checks.
3. Weak Passwords: Short PINs make brute-force attacks easier.
4. IDOR Attack: Users manipulate actor IDs to access others' data.
5. LDAP Exploitation: Attackers modify headers to gain unauthorized roles.

Conclusion

Mobile apps must enforce strict authentication and authorization to prevent unauthorized access and privilege escalation.