Learn how mobile API risks in travel apps can compromise data security and business integrity, and why app attestation is essential in an AI-driven world.

In this insightful episode of "Upwardly Mobile," we look into the critical importance of extending Zero Trust principles to consumer-facing mobile applications. Despite the widespread adoption of the "never trust, always verify" security model across enterprises, mobile apps often remain a significant blind spot, operating in uncontrolled and untrusted environments. This oversight exposes organizations to sophisticated attacks, directly impacting customer trust, regulatory compliance, and revenue. Why is mobile the weakest link in today's Zero Trust architecture and how modern threats like silent escalation, runtime tampering, and reverse engineering specifically target the post-installation, runtime environment of mobile apps. With over 33 million mobile cyberattacks recorded globally in 2024, the urgency to act is clear. Learn about the strategic roadmap for closing this mobile security gap by embedding Zero Trust at the app runtime layer. We discuss how established frameworks such as NIST SP 800-207, the CISA Zero Trust Maturity Model, OWASP MASVS, and the MITRE ATT&CK Mobile Matrix can be adapted to secure mobile applications, focusing on continuous monitoring, verification, and protection. Key takeaways include: • The "Never Trust, Always Verify" Principle for Mobile: Every interaction, from the mobile app to backend APIs, must adhere to strict verification protocols, treating all mobile devices as potentially untrusted. • The Criticality of Runtime Protection: Traditional pre-deployment checks are insufficient as attackers manipulate apps after installation. Continuous monitoring of app integrity and behavior is essential. • Key Components for Mobile Zero Trust: This includes strong Authentication and Authorization (including MFA), Mobile App Attestation to verify app and device integrity, robust API Security, and Secure Communication (e.g., TLS with certificate pinning). • Dynamic Secrets Management: Avoid hardcoding secrets. Instead, manage and deliver them dynamically from the cloud, ensuring sensitive data is never exposed client-side. • Operationalizing Zero Trust Frameworks: Implementing a runtime-centric approach where security decisions are made inside the app, feeding app-level insights into enterprise security operations. • The Business Impact: Proactive mobile app protection reduces breach risks, streamlines compliance (PSD2, GDPR, HIPAA), accelerates secure product delivery, and builds user trust, demonstrating measurable ROI. Sponsored by Approov: Approov provides a comprehensive solution for implementing Zero Trust security in mobile applications and their APIs. Their features include Positive App Authentication, Man-in-the-Middle Attack Protection, Dynamic Secrets Management, and Comprehensive Environment Checks to detect compromised devices and malicious instrumentation. Approov ensures that every call to an API from the mobile app is from a genuine, unmodified app running in a safe environment, with policies updated in real-time. Relevant Links & Resources: • Approov Mobile Security Knowledge Base: https://www.google.com/url?sa=E&q=https%3A%2F%2Fapproov.io%2Fdocs%2Flatest%2Fapproov-mobile-security-knowledge-base%2F • How to Implement Zero Trust for Mobile Apps (Approov): https://www.google.com/url?sa=E&q=https%3A%2F%2Fapproov.io%2Ffor-developers%2Fzero-trust-mobile-apps-implementation%2F • Why Is Zero Trust Not Systematically Applied to Mobile App Security? (Approov): https://www.google.com/url?sa=E&q=https%3A%2F%2Fapproov.io%2Fblog%2Fwhy-zero-trust-not-applied-to-mobile-app-security%2F • Promon SHIELD® for Mobile & More: https://www.google.com/url?sa=E&q=https%3A%2F%2Fpromon.com%2Fproducts%2Fmobile-app-protection%2F • A guide to Zero Trust for your mobile apps (Promon): https://www.google.com/url?sa=E&q=https%3A%2F%2Fpromon.com%2Fresources%2Febooks-whitepapers%2Fzero-trust-for-mobile-apps%2F • OWASP Zero Trust Architecture Cheat Sheet: https://www.google.com/url?sa=E&q=https%3A%2F%2Fcheatsheetseries.owasp.org%2Fcheatsheets%2FZero_Trust_Architecture_Cheat_Sheet.html • OWASP Mobile App Security Verification Standard (MASVS): https://www.google.com/url?sa=E&q=https%3A%2F%2Fpromon.com%2Fknowledge-centre%2Fwhat-is-owasp-masvs%2F • Promon Mobile App Security Library: https://www.google.com/url?sa=E&q=https%3A%2F%2Fpromon.com%2Fresources%2Fall-resources%2F --------------------------------------------------------------------------------

Episode Notes Description: In this episode of Upwardly Mobile, we dive into one of the most pressing cybersecurity threats facing mobile carriers and their subscribers: eSIM swap fraud. While digital SIMs offer superior security against physical theft, they remain vulnerable to sophisticated credential-based attacks and social engineering that target the carrier's systems. We explain how this critical fraud operates and reveal the advanced, cloud-based technologies—App Attestation and Device Binding—that mobile operators are now deploying to verify user identity and device integrity in real time, effectively blocking fraudsters before a swap can be completed. The eSIM Swap Threat eSIM swapping is a form of identity fraud where an attacker convinces a mobile carrier to transfer a victim's phone number to a new eSIM under the attacker's control, often by impersonating the legitimate user remotely. • Attack Method: Attackers often gather personal details from public sources or breaches, then contact the carrier, claiming they need to transfer their number to a new device. Since no physical access is needed, the fraud relies entirely on weaknesses in the carrier’s authentication process. • The Impact: Once a swap is successful, the criminal gains full control over the victim's phone number. They can intercept calls, texts, and, critically, one-time security codes (OTPs) sent via SMS, allowing them to bypass two-factor authentication (2FA) for online banking, cryptocurrency exchanges, and other sensitive accounts, leading to massive financial loss. https://approov.io/blog/why-hackers-love-phones-keep-your-eye-on-the-device To counter these remote, identity-based attacks, carriers are adopting a multi-layered verification approach focused on establishing the trustworthiness of the application and the hardware initiating the swap request. 1. App Attestation This technology focuses on verifying the integrity and legitimacy of the carrier's mobile application. • Verification: App Attestation confirms that the carrier's app being used is the genuine, untampered version downloaded directly from an official app store. • Prevention: It detects if the app has been modified with malicious code or is running in a compromised environment, such as an emulator. If an attacker attempts to use a fake or compromised version of the carrier’s app to initiate a fraudulent eSIM swap request, https://approov.io/mobile-app-security/rasp/app-attestation/ detects and blocks that request. 2. Device Binding Device Binding provides a cryptographic link between a user's account and the unique hardware characteristics of their trusted device. • Secure Link: When a user first logs in, a secure link is created between the app and the device's hardware IDs. • Suspicion Flagging: If a request for an eSIM swap is later initiated from a different, unverified device, the system flags the activity as suspicious, regardless of whether the attacker has stolen credentials. The system can then require additional verification steps or outright deny the unauthorized transfer. This combined approach shifts the security decision-making from the potentially compromised user device to a secure cloud service, making it extremely difficult for attackers to bypass checks through client-side tampering or reverse-engineering. Comprehensive Security Layers for Mobile Carriers Beyond app and device verification, mobile carriers are advised to strengthen defenses through systemic controls: • Stricter Authentication: Implementing secure authentication processes for eSIM transfers, including demanding extra layers like verbal confirmation or a photo ID. • Device Fingerprinting: Binding eSIM profiles to unique device hardware IDs to prevent unauthorized cloning or reuse across multiple devices. • Advanced Analytics: Leveraging AI-Driven Fraud Detection and machine learning to monitor network activity for anomalies, such as unusual call volumes or multiple simultaneous activations, which might signal digital SIM Box fraud schemes. • User Protection Features: Offering tools like Verizon's "SIM Protection," which allows customers to lock lines on their account, prohibiting any transaction requiring a new SIM/eSIM transfer until manually unlocked (with a possible 15-minute delay when unlocking). Protect Yourself: User Best Practices Users must also adopt strong security habits to minimize risk: • Prioritize App-Based 2FA: Always use authenticators like Google Authenticator or Authy over SMS-based two-factor authentication (2FA) for critical accounts, as SMS codes can be intercepted post-swap. • Secure Your Carrier Account: Set a strong password and add an account PIN or passcode with your carrier to prevent unauthorized changes. • Stay Vigilant: Immediately contact your carrier if you notice unexpected loss of cellular service, unusual account alerts, or unauthorized charges, which are common signs of a successful eSIM hack. -------------------------------------------------------------------------------- Sponsor This episode is brought to you by Approov, pioneers in Mobile App and Device Security. Learn how Approov’s App Attestation and Device Binding solutions safeguard your mobile transactions and prevent sophisticated fraud. Visit: https://notebooklm.google.com/approov.io

In this episode of https://approov.io/info/podcast, we delve deep into the sophisticated world of Konfety malware and explore how remote app attestation provides a crucial defence against its cunning tactics. Konfety employs an "evil twin" method, creating malicious versions of legitimate apps that share the same package name and publisher IDs as benign "decoy twin" apps found on official app stores. This allows the malware to spoof legitimate traffic for ad fraud and other malicious activities. Konfety's "evil twins" are distributed through third-party sources, malvertising, and malicious downloads, effectively bypassing official app store security checks. To evade detection, Konfety employs sophisticated obfuscation and evasion techniques. These include dynamic code loading, where malicious code is decrypted and executed at runtime from an encrypted asset bundled within the APK. It also manipulates APK structures through tactics like enabling the General Purpose Flag bit 00 (which can cause some tools to incorrectly identify the ZIP as encrypted and request a password) and declaring unsupported compression methods (such as BZIP) in the AndroidManifest.xml (which can result in partial decompression or cause analysis tools like APKTool or JADX to crash). Other stealth techniques involve suppressing app icons, mimicking legitimate app metadata, and applying geofencing to adjust its behaviour by region. The malware leverages the CaramelAds SDK to fetch ads, deliver payloads, and maintain communication with attacker-controlled servers. Users may experience redirects to malicious websites, unwanted app installs, and persistent spam-like browser notifications. The threat actors behind Konfety are highly adaptable, consistently altering their targeted ad networks and updating their methods to evade detection. So, how does https://approov.io/info/role-of-attestation-in-mobile-app-security combat such a resilient threat? Remote app attestation is a security mechanism where a mobile app proves its identity and integrity to a trusted remote server. This process typically involves the mobile app generating a unique "fingerprint" or "evidence" of its current state, often using hardware-backed security features like Trusted Execution Environments or Secure Enclaves. This evidence includes measurements of the app's code, data, and the device's security posture (e.g., whether the bootloader is locked, if the device is rooted, or if it's running an official OS). This evidence is then sent to a trusted remote server, often an attestation service, for verification. The attestation service compares the received evidence against a known good baseline or policy, checking if the app is genuine and unmodified, if the code running is the expected untampered version, and if the device it's running on is secure and hasn't been compromised. Based on this verification, the server provides a "verdict," which determines whether the app is allowed to proceed with sensitive operations (like accessing premium content or making transactions). Remote app attestation provides specific protections against Konfety by: • Detecting "Evil Twins": Even if the "evil twin" spoofs a package name, its underlying code and environment measurements would likely differ from the legitimate app. The attestation service would detect this mismatch, as the "fingerprint" wouldn't match the expected genuine app. • Preventing Tampering: Konfety's manipulation of APK structures and dynamic code loading aims to hide malicious activity. Remote attestation, particularly if it includes code integrity checks and runtime environment monitoring, would detect these unauthorized modifications or the execution of unapproved code. • Identifying Compromised Devices: If Konfety relies on a rooted or otherwise compromised device to operate, remote app attestation can identify these device security issues, allowing the backend to deny service to that device. • Backend Control: A key benefit is that the decision of trust is made on a secure backend, not on the potentially compromised mobile device itself. This makes it much harder for Konfety to spoof or interfere with the attestation process. Organisations like https://zimperium.com/ offer on-device Mobile Threat Defence (MTD) solutions and zDefend which are noted to protect customers against Konfety malware's new evasion techniques. https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes/ originally uncovered the Konfety operation in 2024, and their Human Defense Platform is stated to protect customers from its impacts. While remote app attestation isn't a silver bullet against all malware, it provides a strong defence against the specific techniques used by Konfety by verifying the authenticity and integrity of the app and its environment before allowing it to interact with critical backend services. Please note that the source materials were provided as excerpts, and direct hyperlinks to the full articles are not available. -------------------------------------------------------------------------------- Keywords: Konfety malware, evil twin apps, mobile app security, remote app attestation, ad fraud, Android malware, obfuscation, dynamic code loading, APK manipulation, CaramelAds SDK, cyber security, mobile threats, Zimperium, HUMAN Security, app integrity, device compromise, malvertising, fraud detection, mobile security solutions, threat intelligence.

Learn how app attestation adds server-side validation to protect against API abuse.

Welcome to another episode of Upwardly Mobile! In this episode, we take a deep dive into the evolution of runtime security for mobile API access. Traditional methods like API keys are easily stolen because they are static and stored directly inside the user's app. To combat this vulnerability, we explore the groundbreaking "Triangle of Trust" architecture developed by CriticalBlue, the company behind the Approov mobile security service. We unpack the technical details of US Patent 11,163,858 B2, titled "Client Software Attestation," which establishes a Zero Trust proof of software integrity for apps operating on the public internet. This episode breaks down how the patented system calculates a cryptographic hash fingerprint of an executing code image to detect tampering in real-time, ensuring that malicious actors cannot spoof access. We also discuss how Approov's platform-agnostic approach provides a significant competitive advantage over OS-native solutions like Google Play Integrity and Apple App Attest, especially in global markets featuring Huawei's HarmonyOS NEXT and non-GMS Android devices. Key Takeaways from this Episode: - The Triangle of Trust: A tripartite architecture separating the security check from the access itself, involving an Issuer (Approov Cloud Attestation Server), a Holder (the Mobile Client Device), and a Verifier (the Backend Server Device). - Dynamic Code Fingerprinting: How client applications calculate a cryptographic hash of their own executing code image to prove integrity, ensuring no sensitive "master keys" are ever stored on the device where they could be extracted. - Protection Against Advanced Threats: The system's ability to thwart "living-off-the-land" attacks (like memory hooking with Frida) and Man-in-the-Middle (MITM) attacks by verifying code dynamically in memory, rather than just checking the static OS state. - Superiority Over OS-Native Tools: Why a unified, cross-platform attestation approach is critical for the global market, bypassing the latency, platform restrictions, and hardware dependencies of Google Play Integrity and Apple App Attest. - A Defensible Security Moat: An analysis of why CriticalBlue's patent is highly defensible and has been cited over 60 times as prior art, acting as a major technical blocker for competitors in the cybersecurity industry. Sponsor: This episode is brought to you by Approov. Stop relying on static API keys and secure your mobile business with deterministic, zero-trust software integrity. With global reach across iOS, GMS Android, non-GMS Android, and HarmonyOS, Approov ensures your backend APIs are shielded from malicious bots and tampered apps. Visit https://approov.com/ to learn more and secure your mobile ecosystem today. Source Materials & Relevant Links: - US Patent 11,163,858 B2: Client Software Attestation by Richard Michael Taylor / Critical Blue Ltd. (Filed 2015, Granted Nov 2, 2021). - Whitepaper Excerpt: Attestation: The Triangle of Trust. - Approov Official Website: https://approov.com/ SEO Keywords: Mobile API security, Zero Trust architecture, App attestation, Approov, CriticalBlue, Cryptographic hash fingerprint, Google Play Integrity alternative, Apple App Attest alternative, Man-in-the-Middle protection, US Patent 11163858, Mobile app tampering, Cybersecurity podcast. 

Explore the myths of no-code mobile app security and discover why minimal-code solutions like Approov offer superior, tamper-resistant app attestation.

Unlocking True Mobile & API Security in the Cloud Age Welcome to "Upwardly Mobile", the podcast dedicated to navigating the complex world of mobile and cloud security! In this episode, we dive deep into why mobile app security and API security are not just technical concerns, but fundamental business imperatives for organisations of all types, from agricultural giants like John Deere to popular dating apps such as Hinge. We explore how the traditional reliance on static defences like code obfuscation is no longer sufficient against today's sophisticated, AI-powered threats, and what a truly resilient, Zero Trust-based security strategy looks like. Why Mobile & API Security Matters to Everyone in Your Organisation: The consequences of neglecting mobile app and API security are severe, ranging from massive data breaches to reputational damage and direct impacts on business operations. Here’s why key stakeholders deeply care: • Operational Leadership & Executives (e.g., C-suite): For companies like John Deere, insecure APIs and mobile apps can lead to attackers accessing, altering, or deleting "sensitive business information related to a farm's operations", resulting in "competitive disadvantage or even sabotage". For dating apps like Hinge, the core business relies on user trust, and API flaws, often exploited via the mobile app, can expose "vast amount of Personally Identifiable Information (PII) for other users", leading to "catastrophic for user acquisition, retention, and the company's survival". The ultimate "consequences of vulnerabilities—such as data breaches affecting billions and leading to hundreds of billions in losses"—fall under their purview. • Security Teams (e.g., CISO, Security Architects): Their mandate is to implement a "holistic" security approach that "protect[s] the app, its communications, and the API". They understand that "APIs are the true target" for attackers and that "a vulnerable mobile app communicating with a misconfigured cloud backend is a recipe for disaster". They are tasked with implementing "robust AppSec Strategy" and "strong Cloud Security Posture Management (CSPM)" to prevent "service disruption" and "full system compromise". • Legal & Compliance Teams: Mobile app and API vulnerabilities, as seen in e-hailing apps, can expose "vast amount of Personally Identifiable Information (PII)". This necessitates their involvement due to potential "severe privacy violations, massive user exodus, and significant legal and regulatory repercussions" associated with data breaches and non-compliance with data protection regulations. • Engineering & Development Teams: These teams are "directly responsible for 'building secure code for both the mobile app and the backend'". They must implement "secure development practices" and are critically concerned with "improper handling of secrets" like API keys, which are often hardcoded and easily extracted. • Marketing & Brand Management Teams: A breach of sensitive user data dueating to API or mobile app vulnerabilities would "severely damage the brand's reputation and trust", directly impacting efforts to attract and retain users. The Flaws in Traditional Mobile Security: • Obfuscation is Not Enough: While code obfuscation aims to deter reverse engineering and IP theft, it is a "thin veil, not an impenetrable shield". It offers "minimal protection against threats that manifest during runtime" and is "ineffective secret protection" as secrets must eventually be in cleartext memory. It can also create a "false sense of security" and is increasingly vulnerable to "modern tools and AI" which can automate deobfuscation. • APIs are the True Target: Attackers are increasingly bypassing the mobile app itself and "targeting the backend APIs directly". APIs provide a "direct pathway to backend application logic and sensitive data stores", making them prime targets for "credential stuffing, account takeover (ATO), scraping, and business logic abuse". Recent incidents involving e-hailing and delivery apps, Experian, and John Deere highlight common flaws like https://approov.io/blog/what-you-need-to-know-about-broken-object-level-authorization-bola and insecure access controls that exposed vast amounts of PII and operational data.The Solution: Embracing Dynamic, Zero Trust Runtime Protection:To address modern threats, a decisive shift from static, pre-deployment security to a "dynamic, runtime-centric model rooted in Zero Trust principles" is essential. This approach entails:• Zero Trust Architecture: This model mandates "never trust, always verify", requiring continuous, runtime verification of devices, users, and networks for access to critical resources. It emphasizes that "trust is never implicit" and acknowledges that traditional static checks and one-time authentication are insufficient. Zero Trust requires "external, cryptographically verifiable measurements that originate outside the app and cannot be forged or intercepted" to avoid a "circular trust problem". • Key Dynamic Defenses:     ◦ https://approov.io/mobile-app-security/rasp/: Acts as the app's "internal bodyguard", detecting and preventing real-time attacks from within the application. It identifies threats like reverse engineering attempts, code tampering, execution on compromised environments (root/jailbreak), and the presence of hooking frameworks. RASP provides "real-time protection" and "zero-day potential" by detecting anomalous behaviour.     ◦ https://approov.io/mobile-app-security/rasp/app-attestation/: This crucial process verifies the "authenticity and integrity of the mobile application instance and its runtime environment" before granting API access. It ensures that only "genuine, untampered app instances" running in a safe environment can interact with APIs, effectively solving the "‘What’ vs. ‘Who’ Problem" (validating the client app in addition to the user). This blocks automated bots, scripts, and tampered apps.     ◦ https://approov.io/mobile-app-security/rasp/runtime-secrets/: This robust solution eliminates the need to hardcode sensitive credentials like API keys directly into the app. Instead, secrets are stored securely in a backend service and delivered "just-in-time" to the validated app instance only after passing rigorous app attestation checks. This protects against both static and dynamic extraction of secrets.    ◦ Dynamic Channel Protection (Dynamic Pinning): Overcomes the brittleness of traditional static certificate pinning. This approach securely retrieves the current, valid set of pins dynamically over the air from a trusted management service (after attestation). This ensures "robust MitM Protection" against Man-in-the-Middle attacks while offering "flexibility and maintainability" for certificate rotations without requiring app updates.• Defense in Depth: An "optimal mobile security strategy employs a defense-in-depth approach, leveraging both static and dynamic techniques". While static analysis and obfuscation can still identify coding errors early, they must be "complemented by robust dynamic and runtime defenses". For applications handling sensitive data or critical functions, dynamic security measures are "fundamental requirements for achieving adequate resilience against modern threats". Empowering Your Mobile-to-Cloud Connection with Approov: Solutions like Approov Mobile Security play a vital role in securing the communication channel between your genuine mobile app and the cloud backend. Approov provides a "unique, patented runtime shielding solution" that focuses on:• Mobile App Attestation: Verifying the integrity of the running mobile app to ensure it's genuine and untampered, preventing bots and modified apps from accessing APIs. • API Request Verification: Cryptographically binding API requests to an attested app instance, ensuring only legitimate requests are processed.• Runtime Secrets Protection: Eliminating hardcoded API keys by securely delivering short-lived tokens to attested apps on demand.• Dynamic Pinning: Providing secure, over-the-air updates for certificate pins, ensuring tamper-proof communication between the app and API. Approov enables "https://approov.io/knowledge/ota-updates-are-essential-for-securing-mobile-apps" for security policies, pin configurations, and attestation logic, allowing instant responses to new threats without requiring app releases. It offers analytics and reporting for monitoring, auditing, and compliance.By adopting a comprehensive AppSec strategy that includes strong cloud security practices and innovative solutions, organisations can significantly reduce their attack surface and protect their users and valuable data.Don't leave your back door open – and ensure only trusted visitors can reach your front door! -------------------------------------------------------------------------------- Sponsored by: Approov Visithttps://approov.io to learn how Approov can safeguard your mobile apps and APIs with advanced runtime protection, app attestation, and secure secrets management. -------------------------------------------------------------------------------- Keywords: Mobile App Security, API Security, Cloud Security, AppSec, Zero Trust, RASP, App Attestation, Runtime Secrets Protection, Dynamic Pinning, Code Obfuscation, Data Breach, PII, Cyber Security, Digital Transformation, Enter

In this episode, we dive deep into the pressing concerns of Internet of Things (IoT) security, especially within our increasingly connected smart homes. From smart refrigerators to water shut-off valves, these devices offer immense convenience but also present tempting targets for cybercriminals. We'll explore the array of vulnerabilities, real-world attack statistics, and the innovative solutions emerging to protect our digital and physical spaces.Key Discussion Points: - The Alarming State of IoT Security: - A shocking 57% of IoT devices are vulnerable to medium- or high-severity attacks, with 70% having serious security vulnerabilities overall. - A staggering 98% of IoT device traffic is unencrypted, and 43% of manufacturers don't even encrypt data during transmission, leaving sensitive information exposed. This is often due to cost-saving measures or limited processing power in basic device chips. - The volume of threats is immense, with 1.5 billion IoT attacks detected in just the first half of 2021. Devices can be targeted within 5 minutes of connecting to the internet, as bots constantly scan for new exploits. - IoT devices are a prime attack vector, accounting for 41% of attacks on enterprises in 2020 and comprising 33% of infected devices in botnets like Mirai. The infamous Mirai botnet, which shut down major internet services in 2016, infected over 25 million IoT devices by exploiting weak or default credentials, turning common items like printers and baby monitors into attack armies. - Smart home attacks rose by 600% in a single year, highlighting the escalating risk to everyday gadgets. - Many organizations face significant challenges, with 72% struggling to discover and classify all IoT devices on their networks, and 67% having limited or no visibility into their IoT environments. - A critical issue is the widespread use of weak or default passwords, responsible for 91% of IoT data breaches, alongside the concerning fact that 40% of IoT devices no longer receive vendor security updates, leaving them vulnerable. - Real-world incidents, such as cyberattacks on municipal water infrastructure, serve as a stark warning, demonstrating that compromised water control systems can have severe physical consequences, including interference with water composition or service disruption. - The Smart Home Ecosystem: A "Toxic Combination" of Apps and APIs: - Smart homes are controlled through a complex web of mobile apps and APIs, connecting everything from smart ovens to security cameras. - This creates a "toxic combination": mobile apps can be cloned, tampered with, or run on compromised devices, while APIs can be reverse-engineered and invoked by bots or fake clients. Attackers can easily automate abuse once app-to-API traffic is understood. - Hackers exploit common issues like lack of app attestation, repackaged or tampered apps, no detection of rooted/jailbroken devices, bypass of obfuscation, API keys hardcoded in the app, and static TLS certificate pins. - Threats extend beyond simple data breaches to more severe outcomes like device hijacking, Man-in-the-Middle (MitM) attacks, ransomware, and botnet creation, allowing malicious actors to manipulate physical devices or launch large-scale attacks. - Even smart water shutoff systems like Phyn, Moen Flo, and Flo-Logic, while protecting against water damage, introduce data privacy implications (e.g., detailed water usage patterns revealing intimate household routines) and the risk of unauthorized remote control by malicious actors who could repeatedly toggle the water supply, causing disruption or damage. Moen's privacy statement explicitly notes its business model includes "monetizing data". - Building a Secure Foundation: Solutions and Best Practices: - Adapting OAuth2 for IoT: The OAuth2 open authorization standard, popular on the web, is being adapted to help secure access to IoT devices. This involves the authorization grant flow where a client obtains an access token to delegate access to server resources. Modifications are necessary for constrained IoT environments, such as dynamically securing the channel between a client and resource server (e.g., Alice's phone and a door lock) by using a possession key shared via the authorization server. Another example is a medical device scenario where the authorization server encrypts the possession key into the access token claims using a pre-provisioned key pair. - Beyond Static Secrets: A more secure approach involves removing static client secrets from mobile apps and leveraging remote attestation services. A dynamic attestation service can verify an app's authenticity at runtime, returning an authenticating, time-limited client integrity token. - Zero Trust Security Model: Smart home platforms should adopt a Zero Trust security model, which inherently trusts nothing by default. Instead, each and every API request must cryptographically prove it originates from a legitimate, unmodified mobile app at runtime. This involves per-request attestation using short-lived, signed tokens and API-side validation. - Approov: Enhancing API and App Security: Solutions like Approov Mobile Security play a crucial role by continuously inspecting the app and device to validate the legitimacy of any request from the app, ensuring only authorized apps can access APIs. This not only protects against bots and unauthorized access but also helps reduce cloud costs and allows API owners dynamic control over access policies and certificates without requiring app updates. - Key Recommendations for Users and Manufacturers: - Always change default passwords immediately upon setup, using strong, unique combinations. - Regularly apply firmware and software updates provided by the manufacturer to patch critical security flaws. - Implement network segmentation, isolating smart home devices on a separate Wi-Fi network (e.g., a guest network or dedicated IoT VLAN) to limit potential lateral movement for attackers if one device is compromised. - Manufacturers must adopt secure development guidelines from day one, conducting regular penetration testing and prioritizing security throughout the product lifecycle, not as an afterthought. - Organizations need robust incident response plans and better visibility into their IoT inventories to quickly identify and address threats. - For critical systems like water shutoff valves, prioritize devices with robust, independent operation (e.g., hardwired connections, substantial battery backups) over those solely reliant on internet connectivity. Protect your connected devices and digital life by understanding these risks and implementing proactive security measures!Relevant Links: - IoT Security Challenges: Device Vulnerability & Attack Stats | PatentPC:https://patentpc.com/blog/iot-security-challenges-device-vulnerability-attack-stats - Phyn (Example of Smart Water Solution discussed):https://www.phyn.com/ - Secure your mobile apps and APIs with Approov:https://approov.io/ Keywords: IoT Security, Smart Home Security, API Security, Mobile App Security, OAuth2, App Attestation, Zero Trust, Mirai Botnet, Data Breaches, Device Hijacking, Network Segmentation, Cybersecurity, Smart Devices, Connected Home, Digital Privacy, Firmware Updates, Password Security, Water Damage Prevention, Phyn, Moen Flo, Flo-Logic, IoT Vulnerabilities, Mobile API Security.

Podcast Title: Upwardly Mobile Episode Title: Beyond Obfuscation: Dynamic Defenses for Modern Mobile Security Episode Summary: In this episode, we dive deep into the evolving landscape of mobile application security. While traditional methods like code obfuscation once offered a basic layer of defense, they are proving increasingly inadequate against today's sophisticated threats. We explore the findings of recent security analyses highlighting widespread vulnerabilities, such as weak cryptography and exposed credentials, even in enterprise apps.  We discuss why static defenses like obfuscation fall short , especially against the rise of AI-powered attacks and the relentless targeting of APIs. Attackers are leveraging AI for everything from hyper-personalized phishing to adaptive malware and automated vulnerability discovery, while APIs present a direct path to backend systems and sensitive data.  The core of our discussion focuses on the critical need to shift towards dynamic, runtime security measures. We break down key technologies essential for modern mobile defense: - Runtime Application Self-Protection (RASP): How apps can monitor their own execution and environment in real-time to detect and block threats like tampering, debugging, and compromised devices.   - Runtime Secrets Protection: Moving beyond hardcoded secrets by delivering API keys and credentials securely, just-in-time, only to validated, genuine app instances.   - Dynamic Certificate Pinning: Securing communication channels against Man-in-the-Middle attacks with more flexibility and less operational risk than traditional static pinning.   - App Attestation & Token-Based API Access: Verifying the integrity of the mobile app itself (the 'what') before granting API access, using short-lived tokens to block bots, scripts, and tampered apps.   We compare static vs. dynamic approaches , emphasizing that while static analysis has its place early in development, dynamic defenses are non-negotiable for protecting sensitive data and functionality in today's threat environment. Learn why embracing these advanced, runtime-aware strategies is crucial for building truly resilient mobile applications.  Keywords:Mobile Security, Application Security, API Security, Code Obfuscation, Dynamic Security, Runtime Application Self-Protection, RASP, App Attestation, Runtime Secrets, Dynamic Certificate Pinning, OWASP Mobile Top 10, API Attacks, AI Security, Cybersecurity, DevSecOps, Mobile App Development, Data Protection, Reverse Engineering, Tampering, Man-in-the-Middle Attack, Credential Stuffing, Secure Coding Source Material Links: - Infosecurity Magazine Article:https://www.infosecurity-magazine.com/news/92-mobile-apps-insecure/   - OWASP Resources (API Security, Mobile Security, Cheatsheets, MASTG): - https://owasp.org/www-project-api-security/   - https://owasp.org/www-project-mobile-top-10/   - https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning   - Approov Resources (Runtime Secrets, Dynamic Pinning, API Security, Attestation, Obfuscation Limitations): - https://approov.io/   - https://securityboulevard.com/2022/07/hands-on-mobile-app-and-api-security-runtime-secrets-protection/   - https://approov.io/knowledge/owasp-top-10-mobile-risks-m5-insecure-communication   - https://approov.io/mobile-app-security/rasp/runtime-secrets/   - https://approov.io/mobile-app-security/rasp/api-security/   - https://approov.io/blog/mobile-api-security-best-practices   - https://approov.io/blog/is-code-obfuscation-worth-it   - https://approov.io/blog/why-the-owasp-mobile-application-security-project-is-critical   - Promon Resources (API Protection, Obfuscation, App Shielding): - https://promon.io/products/api-protection   - https://promon.io/resources/downloads/guide-app-code-obfuscation   - AI Attack Techniques & Mobile Security: - https://www.nowsecure.com/blog/2024/11/13/the-ai-expansion-of-the-mobile-app-attack-surface-2/   - https://symmetrium.io/how-hackers-use-ai-to-target-corporate-mobile-devices/   - https://www.akamai.com/blog/security/attacks-and-strategies-for-securing-ai-applications   - https://securityboulevard.com/2024/12/why-over-the-air-updates-are-key-for-mobile-app-security-in-the-ai-era/   - https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/ai-powered-cyberattacks/   - https://cyberpress.org/ai-driven-bad-bots-now-make-up/   - https://perception-point.io/guides/ai-security/ai-malware-types-real-life-examples-defensive-measures/   - General Security & Testing Resources: - https://brilliancesecuritymagazine.com/cybersecurity/runtime-secrets-protection/   - https://www.cobalt.io/blog/owasp-mobile-top-10-2024-update   - https://www.devopsdigest.com/avoiding-the-top-mobile-api-security-weaknesses   - https://www.guardsquare.com/   - https://www.cyberdefensemagazine.com/rasp-runtime-application-self-protection-in-mobile-application-security-a-strategic-imperative-for-the-modern-threat-landscape/   Sponsor Link:This episode is brought to you in part by Approov. Secure your mobile apps and APIs against modern threats. Learn more athttps://approov.io/.

Episode Summary: In this episode of Upwardly Mobile, we unpack the unsettling incident involving TeleMessage, a modified clone of the secure messaging app Signal, its use by the U.S. government, and the subsequent data breach. We explore how a lack of fundamental security measures like app attestation and token-based API access created gaping vulnerabilities, allowing a hacker to access sensitive archived data. Drawing on insights from the sources, we discuss why encryption alone is insufficient and highlight the urgent need for robust client-side security to protect sensitive communications and safeguard brand trust in the digital age. Key Takeaways: - An obscure Israeli company called TeleMessage offers modified versions of secure messaging apps like Signal, WhatsApp, Telegram, and WeChat, primarily for archiving purposes to meet compliance requirements for organisations, including the U.S. government. - Former National Security Advisor Mike Waltz was reportedly photographed using a modified version of Signal by TeleMessage, labelled "TM SGNL," during a cabinet meeting, bringing attention to the use of such apps in sensitive government contexts. - Despite being based on Signal’s open-source code, TeleMessage lacked core security defences such as robust app attestation and secure token-based API access control. This allowed the repackaged and unverified app to establish trust with the Signal backend and interact with secure infrastructure as if it were legitimate. - A hacker successfully breached TeleMessage and stole customer data, including contents from direct messages and group chats from its modified apps. This hack demonstrated serious vulnerabilities, revealing that archived chat logs were not end-to-end encrypted between the modified app and the archiving destination. - Data related to sensitive entities, including Customs and Border Protection (CBP) and the cryptocurrency giant Coinbase, were reportedly included in the hacked material. - The incident underscores the critical need for app attestation, which ensures only authentic, unaltered app versions running in secure environments can access backend APIs. - Key components of effective app attestation include runtime integrity verification and dynamic token issuance. This approach prevents repackaged, emulated, or jailbroken clients from accessing protected endpoints or receiving secrets. - Solutions like Approov offer third-party app attestation services that provide comprehensive coverage across iOS and Android, including on jailbroken or rooted devices where platform-native solutions may be limited. Approov also includes features like dynamic certificate pinning and runtime secrets protection. - The sources suggest that widespread API insecurity is partly due to limitations in platform-native security tools from Apple and Google and their resistance to allowing deeper integration of third-party security solutions. - While Signal’s end-to-end encryption is a strong foundation, its leadership has been criticised for not addressing the security mechanics that uphold it, specifically app attestation. Encryption alone is not sufficient if the app client itself can be easily repackaged and compromised. - The lack of attestation enforcement has tarnished Signal's brand reputation, as users cannot easily differentiate between the legitimate app and a clone. - Organisations handling sensitive data should mandate app attestation and token-based API access, utilise robust third-party attestation services, and hold app providers accountable for architectural flaws that enable brand misuse. Security must begin with verifying the source of every API call. Relevant Links: - Read more about the TeleMessage hack: Based on "The Signal Clone the Trump Admin Uses Was Hacked" and "What Is TeleMessage? Mike Waltz Reportedly Caught Using Obscure App". (Note: Specific URLs are not provided in the sources). - Explore solutions for mobile app and API security, including app attestation: Learn more at approov.io. Keywords: Signal, TeleMessage, TM SGNL, Mike Waltz, App Attestation, API Security, Mobile Security, Secure Messaging, Encryption, Data Breach, Hacking, Government Security, Compliance, Archiving, Fake Apps, Clone Apps, Repackaged Apps, Approov, Runtime Integrity, Token-Based API Access, Mobile App Security, Backend Security, 404 Media, Newsweek, Cybersecurity, Infosec, Privacy.

Securing APIs: Mobile App Vulnerabilities Meet the Rise of AI Agents Episode Notes:Welcome to Upwardly Mobile! In this episode, we delve into the critical and rapidly evolving landscape of API security, focusing on the unique challenges presented by mobile applications and the increasing prevalence of autonomous AI agents accessing these APIs. As AI paradigms become standard, technology is racing to keep up, especially with the shift toward AI agentic API consumption in 2025. This presents significant security considerations, requiring a rethinking of how systems are secured and access is ensured.Mobile applications rely heavily on backend APIs to power their features across various platforms like iOS, Android, HarmonyOS, Flutter, and React Native. However, mobile apps are one of the most common attack vectors for API abuse. Even well-coded apps can be reverse-engineered, allowing their APIs to be abused. Key Mobile API Security Risks: - Abuse by Automated Scripts and Bots: Automated bots or scripts can simulate legitimate app traffic at a malicious scale, leading to data scraping, rapid transactions, overwhelming backend systems, or enabling abuse like mass account creation or credential stuffing. Distinguishing genuine users from scripts/bots is a key challenge, and many organizations lack the means to differentiate. - Use of Stolen API Keys or Tokens: Mobile apps often contain secrets like API keys or tokens. If hardcoded or stored insecurely, attackers can extract and reuse them for illicit API calls, allowing them to masquerade as the app or user. Real incidents have shown thousands of apps leaking hardcoded keys, which can lead to impersonation, huge bills, or data breaches. Any API key or token shipped in a mobile binary is at risk via reverse engineering. Relying only on static secrets is insufficient. - Replay Attacks on API Requests: Attackers can intercept legitimate API requests or tokens and re-send them to the server. If the server cannot distinguish old requests from new ones, it might process actions multiple times. This is due to a lack of freshness or binding; without timestamps or nonces, a captured message could be valid forever. - Lack of App Attestation or Authenticity Checks: Without attestation, the backend cannot truly know if an API request is from a legitimate app instance on a real device or from an emulator, rooted device, or fake client. This allows attackers to run modified apps or scripts in untrusted environments and still successfully call APIs, enabling headless abuse and bypassing client-side protections. - Reverse Engineering and Repackaging: Mobile apps are easily reverse-engineered. Attackers can decompile binaries to discover endpoints, hardcoded keys, and logic, then write their own tools to mimic app behavior. This underpins many threats, allowing attackers to bypass client-side security checks and abuse APIs directly. Traditional authentication methods like static API keys and standard user logins often fall short because they don't verify the client originating the request. Once a shared secret is compromised, the API is vulnerable. Attackers are increasingly using cloud resources and AI agents to automate attacks and exploit vulnerabilities at scale.AI Agent-Specific Security Vulnerabilities:The rise of autonomous AI agents introduces a new set of security risks that compound traditional concerns. Agents can make decisions and interact with external tools like APIs without constant human oversight. - Prompt Injection & Indirect Prompt Injection: Attackers craft inputs that cause the agent model to ignore developer instructions and follow attacker commands instead. This can lead the agent to alter behavior, reveal data, or perform unauthorized actions. Indirect injections hide malicious instructions in external content (web pages, emails, databases) that the agent processes. This can "hijack" an agent, turning it into a tool for unauthorized access or actions. Agents accessing APIs are especially vulnerable, as prompt injection can lead to unauthorized API calls. - Model Manipulation and Backdoors: Attackers can manipulate the agent's parameters or learned behavior. This might involve introducing hidden triggers (backdoors) into the model, often via poisoned training data. A backdoored model behaves normally until a specific trigger activates malicious behavior. - Data Poisoning (Training and Memory): Intentionally corrupting data used to train, fine-tune, or provide context to the AI can introduce vulnerabilities or biases. Poisoning can target training data, fine-tuning stages, or reference data like vector databases used in Retrieval-Augmented Generation (RAG) systems, injecting hidden instructions or misinformation. - Unauthorized API Access and Tool Misuse: Autonomous agents calling APIs introduce authorization and access control risks. An agent could be manipulated into accessing data or performing actions that should be off-limits, essentially performing privilege escalation on behalf of the user. Examples include exploiting the agent to perform Broken Object Level Authorization (BOLA) or Broken Function Level Authorization (BFLA) attacks. Agents that fetch URLs can also be exploited for Server-Side Request Forgery (SSRF) attacks, potentially accessing internal network resources. - Over-Permissioning and Excessive Agency: Granting an AI agent more permissions than necessary significantly increases risk. If a compromised agent has broad access to functions or systems, even a minor exploit like prompt injection can lead to catastrophic outcomes across confidentiality, integrity, and availability. Agents should operate with minimal necessary privileges. - Malicious Instruction Chaining: Sophisticated attacks involve chaining instructions over multiple interactions or prompt segments to achieve a malicious goal. This multi-prompt approach can bypass security filters that check prompts individually. Agents that maintain state or memory are particularly susceptible.