OWASP Top 10 - M8: Security Misconfiguration

Security Misconfiguration in Mobile Apps

Threat Agents
Attackers exploiting misconfigured security settings, permissions, or controls to gain unauthorized access. Threat agents include:

• Attackers with physical device access
• Malicious apps exploiting vulnerabilities

Attack Vectors (Difficult to Exploit)

• Insecure default settings (weak security configurations)
• Improper access controls (unauthorized data access)
• Weak encryption/hashing (exposing sensitive data)
• Lack of secure communication (eavesdropping risk)
• Unprotected storage (plain-text sensitive data)
• Insecure file permissions (world-readable/writable)
• Misconfigured session management (session hijacking)

Security Weakness (Common, Easy to Detect)
Misconfigurations arise from time constraints, lack of awareness, or human error. Common issues:

• Debugging features left enabled in production
• Insecure communication (HTTP instead of HTTPS)
• Default usernames/passwords unchanged
• Weak access controls allowing unauthorized actions

Impacts (Severe)

• Technical: Unauthorized access, account hijacking, data breaches, backend compromise
• Business: Financial loss, reputational damage, downtime, legal penalties

Vulnerability Indicators

• Default settings not reviewed
• Weak encryption or absent access controls
• Failure to apply security patches
• Improper storage of sensitive data
• Exported activities or insecure file provider paths

Prevention Measures

• Secure default settings & avoid hardcoded credentials
• Follow least privilege principle for permissions
• Disable debugging & backup mode in production
• Use HTTPS & certificate pinning
• Restrict exported activities and file provider paths

Example Scenarios

1. Insecure default settings: Weak security configurations exploited.
2. Insecure file provider path: Other apps access sensitive files.
3. Overly permissive storage permissions: Apps can read sensitive data.
4. Exported activity: Attackers gain extra attack surface.
5. Unnecessary permissions: Apps request excessive, non-essential permissions.