Security Smells Pervade Mobile App Servers

TL;DR

This study reveals that a significant majority of mobile app servers suffer from security smells, such as misconfigurations and unprotected communication, which pose substantial security risks and are caused by poor maintenance practices.

Contribution

It provides an empirical analysis of security smells in mobile app servers and highlights their prevalence and security implications.

Findings

Over 69% of apps have at least three security smells.

Unprotected communication and misconfigurations are very common.

Source-code leaks and lack of updates increase security risks.

Abstract

[Background] Web communication is universal in cyberspace, and security risks in this domain are devastating. [Aims] We analyzed the prevalence of six security smells in mobile app servers, and we investigated the consequence of these smells from a security perspective. [Method] We used an existing dataset that includes 9714 distinct URLs used in 3376 Android mobile apps. We exercised these URLs twice within 14 months and investigated the HTTP headers and bodies. [Results] We found that more than 69% of tested apps suffer from three kinds of security smells, and that unprotected communication and misconfigurations are very common in servers. Moreover, source-code and version leaks, or the lack of update policies expose app servers to security risks. [Conclusions] Poor app server maintenance greatly hampers security.