NextBillion - An Initiative of the William Davidson Institute at the University of Michigan

Wednesday, August 12, 2015

The developing world is increasingly using mobile banking apps to move money, but new research shows those apps are often poorly coded and pose security risks.

Researchers with the University of Florida looked at dozens of apps used for mobile money systems but extensively analyzed seven that have millions of users in Brazil, India, Indonesia, Thailand, and the Philippines.

The problems they found represent a large attack surface, including SSL/TLS issues, botched cryptography, information leakage and opportunities to manipulate transactions and modify financial records.

The impact of the problems is unknown, but “it is possible that these apps are already being exploited in the wild, leaving consumers with no recourse to dispute financial transactions,” according to their research paper, to be presented on Wednesday at the 24th USENIX Security Symposium in Washington, D.C.

So-called “branchless” banking systems using mobile apps have revolutionized banking in developing countries, where the poor have long suffered from difficult access to traditional banking systems, they wrote.

In some countries, branchless banking apps are used for 30 percent of some nations’ GDP, relying on the near universal deployment of cellular network and mobile devices.