Issue Details
Insecure Communication
mobile03 • Rank #3 in OWASP 2024
Explanation
Mobile apps communicate with backend services over networks that may be monitored or compromised. Insecure communication includes using HTTP instead of HTTPS, improper certificate validation, or weak encryption. Attackers on the same network can intercept and modify traffic through man-in-the-middle attacks.
Remedy
Enforce TLS 1.2+ for all network communications. Implement certificate pinning to prevent MITM attacks. Validate server certificates properly and avoid accepting self-signed certificates in production. Encrypt sensitive data before transmission as an additional layer.
| Year | Rank | Category |
|---|---|---|
| 2016 | #3 | mobile03 - Insecure Communication |
| 2024 | #3 | mobile03 - Insecure Communication and Network Attacks |