MobileFirst Native App security check

0
votes

We are working on native app using MobileFirst 7.1 and I was checking how MFP protect our app if we ran the case below:

The attacker used the same bundleID and same app name targeting our server and ran the app on simulator which doesn't need any cert to do that.

The Wlapp that is genrated from the native API will only have what ever defined in the application descriptor.

For example:

App1 (legit):

<nativeIOSApp id="MobileiOSNative" platformVersion="7.1.0.00.20170627-0807" bundleId="ca.company.test1" 
version="1.0" xmlns="http://www.worklight.com/native-ios-descriptor" applicationId="MobileiOSNative" securityTest="TestMobile">

App2 (attacker) using the same info as the App1:

<nativeIOSApp id="MobileiOSNative" platformVersion="7.1.0.00.20170627-0807" bundleId="ca.company.test1" 
    version="1.0" xmlns="http://www.worklight.com/native-ios-descriptor" applicationId="MobileiOSNative" securityTest="TestMobile">

What could stop the attacker from contacting our server ?

I have went through this URL and not sure I have the proof that cover the above case:

https://mobilefirstplatform.ibmcloud.com/tutorials/en/foundation/7.1/authentication-security/application-authenticity-protection/

1
securityibm-mobilefirst

1 Answers

0
votes

While an attacker can contact the MobileFirst server using the technique you mentioned, it cannot do cannot do any damage since the app cannot be published on the app store. Furthermore, since your adapters & backend resources will be protected by security checks, unless the credentials are available, the backend cannot be accessed.

In spite of this, for additional security, you could use the Extended App authenticity that is available for iOS & Android apps. However, due to changes in the way Apple handles .ipa files after uploading them to the App Store, this feature is currently limited to Android apps and iOS apps not distributed through the Apple App Store.

If you upgrade to MobileFirst v8, you can use Dynamic app authenticity which will cover all the cases including apps distributed through Apple App Store.