McAfee, the cyber-security firm, has issued a stern warning to mobile app developers to update their mobile app software, to protect users against well known vulnerabilities in popular secure communications software.

According to Tech Times;

In January this year, McAfee tested 25 apps that were on the CERT list. According to the cybersecurity firm's "Labs Threats Report: February 2015," tests found that 18 popular apps were still lacking patches despite security holes being flagged in September 2014.

Based on the report, the vulnerable app that had been downloaded the most is a photo editor for smartphones. It had 100 million to 500 million downloads. The application also enables its users to share images on social media sites, as well as cloud services.

Read More...

What does this mean for mobile app developers?

The McAfee report comments on the amount of personal information mobile apps gather about their users.

However, one of the most serious problems arises from the use of old versions of a popular software library, openSSL, to provide secure communications between mobile app users and servers, or other users.

OpenSSL – the heart of Internet Security

openSSL is popular because it works – it provides by far the most trusted and most comprehensive implementation of secure communication. If you include openSSL (libSSL) in your mobile app development project, you don’t have to create fantastically complex encryption code yourself. All you need to do is add a few lines of code to your mobile app project, to ask openSSL to create the secure communication channel for you.

Because of its popularity, openSSL code is a key target for hackers. If you find a way of breaking openSSL, half the world is vulnerable to your attack. The flip side of this, of course, is because openSSL is so popular, a lot of people take a strong interest in keeping openSSL secure. When a new way of hacking openSSL is discovered, developers across the world spring into action, and within hours, or at most few days, an update is available which closes the hole in openSSL security.

However there is a catch. Keeping your use of openSSL secure very much depends on you keeping your copy of openSSL (libSSL) up to date, to ensure you have all the latest security updates. If you don’t keep your copy of the openSSL libSSL library code up to date, your mobile app will still work – but it will become progressively more vulnerable to hackers, as more and more attacks are discovered which work on your out of date copy of the security library. This damaging rise in the vulnerability of your mobile app is subtle, and difficult to detect. Unless your mobile app developers make a conscientious effort to stay in control of this issue, the first indication you might have that your popular mobile app has a problem, might be unwelcome, damaging publicity in the global media.

Note that many mobile apps do not use their own copy of openSSL (libSSL). Many mobile apps simply use the default security classes provided by the mobile app development environment. Both the Android App Development environment and the iPhone App Development environment provide good security out of the box, without having to incorporate your own copy of the openSSL (libSSL) code. But there are situations in which you need full access to security functionality, access which goes beyond the basic facilities provided by the standard mobile app development environment tools. In such cases, you have to download and include a copy of the openSSL / libSSL code into your project.

What should you do, to stay safe?

What do you do if you are concerned that your mobile app might be vulnerable to this issue? The first step is to simply ask your mobile app development team – do they use a private copy of openSSL / libSSL, and, if so, when was the last time they updated their openSSL code?

If you are not completely satisfied with their answer, the next step is to commission an independent audit of your code – either ask another developer to verify that the secure communications employed by your mobile app comply with best practice, and that everything is up to date, or if you have a big budget, you can hire a reputable mobile security firm, like McAfee, to perform a comprehensive security audit on your mobile app system.

If you would like to know more about the content of the McAfee security report, and how the issues raised in the report might affect your mobile app business, please contact me.

6 Things You Need to Know Before Building a Mobile App is a story published in the Huffington Post. If you are serious about mobile app development, I strongly recommend you read it.

For example, consider the section on how much it costs to build a mobile app:

1. What Will It Cost?

This question is one of the most commonly asked questions regarding app development, and is the same as asking “what does a house cost?” Ultimately, there are different variables, features, and development processes to consider, and then it furtner varies from project to project.

If you are planning to build the app yourself or you have access to an in-house development team, the cost would depend on the amount of time you put into the project. If you can do this in your spare time, it will only cost you your time and skills. However, keep in mind that most professionally developed applications require a team-effort, usually consisting of a product manager, designer, developers, testers, and marketing experts.

The leading mobile app developer review company Clutch recently surveyed representatives from 12 leading mobile app development firms to determine cost ranges for building an iPhone app “and found that the median cost range is between $37,913 and $171,450, but could climb up to $500,000 or higher. The best way to find out where your app will fall in that range is to obtain price quotes from several development companies;” One of the 12 firms surveyed by Clutch was Digital Brand Group, and the CEO Jeremiah Jacks is a friend of mine. Something to keep in mind that Jeremiah mentioned is that “what you get from a lot of development companies is that they treat their customers from a kind of manufacturing standpoint, where they’re getting in a contract, they’re looking at a scope, and they’re just delivering on the scope. They’re not going any further beyond that.”

If you’re going to hire a mobile development company, then at least choose one where your money is going to count for something, and the vendor doesn’t look at you as just a number – you will need a partner. DBG has a good whitepaper on selecting a top mobile development company to help you decide.

Finally, innovative mobile application ideas can also be promoted on crowdfunding platforms like Kickstarter. In this way you may be able to raise funds externally before you have to spend money out of your own pocket. Make sure you have a killer pitch if you want to increase your chances of raising money through crowdfunding, and keep in mind that once your idea is out there, you have limited time before someone else takes off with your idea.

Read More…

A lot of this is material which has been covered before on the Desirable Apps website, but it doesn’t hurt to re-read material you may have read before, especially if you are considering making a substantial investment. The Huffington Post article is well presented and informative.

If you have any questions about the process of building a mobile app, or any other considerations, please contact me.

Katy Perry has commissioned the development of a new mobile game, from the same developers who created the “Kim Kardashian: Hollywood” game.

According to Business Insider Australia;

The new game, which has yet to given an official title, will feature Perry’s voice and likeness and promises to “introduce players to a digital playground of global success and talent,” according to the press release.

“Kim Kardashian: Hollywood” was also a free-to-play game, but the game offered in-app purchases that allowed players to use real money to purchase additional playing time and virtual clothes with the game’s currency, “K-stars.”

The strategy worked well for Glu Mobile and Kardashian. “Kim Kardashian: Hollywood” dominated the Apple App Store charts, peaking at the #1 overall spot and #4 in top-grossing apps. It raked in $US1.6 million in its first five days on the market, and has since been downloaded 22.8 million times, generating $US43 million in revenue from its June launch through the end of September.

Creating a mobile app is an obvious merchandising dimension for already famous hollywood stars, especially given spectacular successes like the multi-million dollar Kardashian mobile app. However, mobile apps often succeed without backing from famous people. But what about the reverse – could a successful mobile app help someone break into hollywood?.

Could a mobile app be your big break in a Hollywood acting career?

To some extent we’ve already seen at least one example of this – the blockbuster Angry Birds mobile app has spawned, among other things, its own cartoon franchise.

But imagine a game based on a copyrighted Sacha Baron Cohen character such as the dictator of the fictional nation of Wadiya. In principle the mobile app could help drive the rise in popularity of the character – just as Angry Birds spawned a cartoon franchise, so a successful mobile app could spawn demand for a movie franchise.

Crazy? Impossible? Well it has already happened – not with a mobile app (as far as I know), but with the blockbuster console game Halo. The game created demand for a movie – Halo: Helljumper, released in 2010.

The lesson is clear – if you want to be a Hollywood Star, consider creating a mobile app. The Katy Perry App will do well – but it is unlikely to be the same runaway success as the Kim Kardashian game. Why? Because the Kardashian game came first. There is a potential opportunity here – Contact Me if you want to be the person who seizes that opportunity.