A spate of data breaches in Japan has revealed that smartphone apps, readily available to anyone, have become one of the entry points for attacks. On October 13, the National Institute of Information and Communications Technology (NICT) announced that it had analyzed publicly available Android apps and identified "A2B attacks (App-to-Backend Attack)" targeting connected servers. NICT is urging caution, stating that the use of AI could further escalate these attacks.
In an A2B attack, an attacker obtains a publicly available Android app and analyzes its internal structure. This attack method involves investigating the server connection destinations that the app communicates with, as well as APIs (Application Programming Interfaces) – the mechanisms for data exchange – to target server vulnerabilities.
The problem is that attackers may gain knowledge of server specifications that app providers did not intend to make public. If the server has vulnerabilities, it can lead to unauthorized access. Damage can occur even if the app is not hijacked or the user's smartphone is not infected with a virus.
A further concern is the efficiency of attacks enhanced by AI. If app analysis and vulnerability scanning become automated and accelerated, attackers will be able to investigate numerous services in a short amount of time. NICT points out that similar problems could arise not only with Android but also with iOS apps and web services.
As countermeasures, NICT recommends three actions: "Confirming compromise," "Inspecting for vulnerabilities," and "Implementing temporary mitigation measures." The published warning also includes information on specific attack methods, common vulnerabilities targeted, and how to investigate traces of unauthorized access.
