mHealth Apps Expose Millions to Cyberattacks

Some 23 million cellular overall health (mHealth) application consumers are exposed to application programming interface (API) attacks that could expose delicate information, in accordance to scientists.

Typically talking, APIs are an middleman amongst apps that defines how they can talk to a single another and making it possible for them to swap information. Researcher Alissa Knight with Approov experimented with to split into the APIs of 30 different mHealth app vendors, with the agreement she would not ID the vulnerable ones. Turns out, they had been all vulnerable to just one degree or a different.

The typical number of downloads for each app tested was 772,619.

According to the resulting report from Approov, out of 30 popular mHealth applications analyzed, 77 percent of them contained hardcoded API keys, which would permit an attacker to intercept that exchange of facts — some of which really do not expire. Seven per cent of these belonged to third-party payment processors that explicitly alert in opposition to hard-coding their solution keys in basic text.

An additional 7 % contained hardcoded usernames and passwords.

 

But which is not all: Much more than a quarter (27 per cent) of cell applications tested did not have code-obfuscation protections versus reverse engineering and all of them without exception lacked certificate pinning, which helps prevent male (or lady) in the middle (MITM) attacks, for intercepting communications to observe and manipulate information.

Also, a comprehensive 50 percent of the APIs analyzed did not authenticate requests with tokens.

And finally, if one particular patient’s information can be accessed, generally quite a few other people can be accessed indiscriminately: 100 p.c of API endpoints analyzed had been susceptible to Broken Object Stage Authorization (BOLA) attacks, which permitted the researcher to perspective the personalized overall health info (PHI) and individually identifiable information and facts (PII) for patients that were being not assigned to the researcher’s clinician account.

For context, the report stated there are far more than 318,000 applications out there in major app outlets.

Healthcare Documents Entice Cybercriminals

The pandemic has pushed hospitals and healthcare companies to count significantly on mHealth applications. But the analysis reveals they’re are generally susceptible to attackers, leaving critical and beneficial health facts sitting down there just waiting to get ripped off.

What’s been exacerbating the security posture of cellular wellbeing applications is the mad hurry to innovate first, protected 2nd, Knight spelled out to Threatpost. And now is the time for security to catch up just before a massive breach occurs, she included.

Threat actors meanwhile have a large monetary incentive to focus on these mHealth APIs. Knight pointed out that whilst the likely charge amongst cybercriminals for a Social Security variety is $1 and a credit rating-card variety sells for about $110, the major money is in full health care documents, which fetch about $1,000 apiece.

“This escalating attack surface area is promptly drawing the attention of transnational criminal offense syndicates wanting to lock-and-leak it in get to extort payments from its information homeowners and provide it to the maximum bidder,” Knight wrote in the report.

What is the Best mHealth App Risk?

BOLA (a.k.a. Insecure Direct Item Reference, or IDOR) is the most prevalent abuse vector for mHealth APIs, Knight explained, pointing out it’s no coincidence that OWASP’s recently released list of best API threats put these types of vulns at the top rated.

“Simply put, a BOLA vulnerability permits an adversary to substitute the ID of a useful resource with the ID of yet another,” Knight spelled out. “When the item ID can be right called in the URI, it opens the endpoint up to ID enumeration that allows an adversary the potential to go through objects that really don’t belong to them. These exposed references to internal implementation objects can level to nearly anything, no matter whether it’s a file, directory, databases history or crucial.”

In-the-lab BOLA attacks done by Knight cracked 100 percent of the apps she examined, supplying her theoretical obtain to downloadable comprehensive affected individual information, which includes lab effects, x-ray illustrations or photos, blood operate, loved ones background, delivery dates, Social Security numbers and much more.

API Authorization As opposed to Authentication

Knight described to Threatpost that when it arrives to APIs, CISOs and security groups want to believe about the difference between authentication and authorization.

Knight utilised the analogy of security at a nightclub.

In an authorization-only state of affairs the bouncer (the authorizer) checks IDs and establishes who is permitted inside of the bar. So that within, everyone who walks up the bar and orders a drink, the bartender can just suppose, is authorized to consume alcohol.

But in an authentication state of affairs there are two checks.

The bouncer checks IDs and issues wrist bands to these permitted to consume. The moment at the bar, the bartender (the authenticator) appears for a wristband as an added layer of scrutiny. The bartender double-test confirms the human being is not just licensed to be in the bar, but it also makes certain their identity is authenticated to make guaranteed they’re each permitted inside of and authorized to eat alcohol.

APIs get the job done much the exact same way, Knight described. Fifty percent of the mHealth APIs she analyzed for this report didn’t authenticate requests with tokens.

“Types of authentication in APIs include API keys, a long string of random figures and figures generated by the API endpoint that grants obtain to whomever passes it in the authorization header of the request Essential Auth the place a username and password are employed to authenticate an unique JSON Web Tokens (JWTs) and OAuth, which works by using tokens in its place of sharing qualifications OAuth2, which exchanges a username and password for a token Good, which is progressively turning out to be an implementation of OAuth in health care and OpenID Join,” Knight said. “There are also other strategies of authentication, such as utilizing multifactor authentication through third-party methods.”

Implementing Far better mHealth Cybersecurity

David Stewart, founder and CEO of Approov, spelled out that present security standards are not enough to deal with soaring security threats to cell wellbeing apps. Companies will need to do much more.

“These findings are disappointing but not at all shocking,” Stewart said. “The simple fact is that major builders and their corporate and organizational prospects continuously fall short to understand that APIs servicing remote customers these kinds of as cell apps need a new and committed security paradigm. ”

Heathcare entities need to recognize that APIs are an open up door for malicious actors, especially in the worthwhile PHI industry, he underlined.

“Because so couple businesses deploy protections for APIs that make certain only legitimate cellular app scenarios can hook up to backend servers, these APIs are an open up doorway for menace actors and present a authentic nightmare for susceptible businesses and their people,” Stewart said.

Help you save your location for “15 Cybersecurity Gaffes SMBs Make“:

Join us for a  FREE Threatpost webinar on Feb. 24 at 2 p.m. ET. Cybercriminals depend on you building these problems, but our specialists will assist you lock down your smaller- to mid-sized small business like it was a Fortune 100. Register NOW for this LIVE webinar on Wed., Feb. 24.