OWASP Top 10 - M10: Insufficient Cryptography

Insecure Cryptography in Mobile Apps

Threat Agents: Attackers exploit weak cryptography to decrypt data, manipulate encryption, or gain unauthorized access.

Attack Vectors (Exploitability: AVERAGE): Weak algorithms, poor key management, and flawed implementations allow brute-force, MitM, and downgrade attacks.

Security Weakness (Prevalence: COMMON | Detectability: AVERAGE):

• Weak encryption, insufficient key lengths.
• Poor key storage & management.
• Insecure transport (e.g., missing HTTPS).
• Weak hash functions without salting.

Impact (SEVERE):

• Data breaches (PII, financial data leaks).
• Intellectual property loss (decrypted proprietary data).
• Financial & legal consequences (fraud, non-compliance).

Prevention:

• Use strong encryption (AES, RSA, ECC).
• Secure key storage & management (HSMs, vaults).
• Implement secure transport (HTTPS, certificate validation).
• Use strong hashes (SHA-256, bcrypt) with salting.
• Regularly update cryptographic libraries & conduct security tests.

By following these best practices, mobile apps can mitigate cryptographic vulnerabilities.