Results of Scanning the Top 45 Android Mobile Banking Apps
summary
Scans of 45 top US Android banking apps find concrete failures: about 75% fail insecure data storage, many apps contain hardcoded API keys and inline credentials, and two apps score as high-risk 82 and 81 on a 0–100 weighted security/privacy scale. Multiple apps load executable code from external storage or webviews and are actively targeted by the BankBot overlay campaign; a continuous-scanning pipeline (Jenkins/TeamCity) and a Zirium SDK are used to detect and report these issues.
AI-written summary · about
chapters (14)
- 0:00Introduction and setup
- 1:19State of mobile banking
- 8:31Scanning methodology
- 9:54OAS mobile top 10 results
- 10:59Permissions and privacy risks
- 12:30Advertising SDKs in banking apps
- 13:54Shared code in banking apps
- 14:14Security and privacy scores
- 15:38Detailed app analysis examples
- 21:57Impact on 184 million users
- 22:18Worst offenders breakdown
- 26:39iOS vs Android comparison
- 27:46GDPR and privacy fines
- 31:08Summary and Q&A
related talks
57m(In)Security of Mobile Banking
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
31mHow I hacked 30 mobile banking apps & the future of API Security
24mModern Android App Security: Protecting Code, Keys, and Data
15mBest practices for shielding mobile apps from emerging threats
33mBest Practices for Mobile App Security Testing
21mWhen Attackers Go Mobile-First: What Developers Need to Know
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security