China and India present new Challenges and Opportunities

Pinduoduo Malware highlights the need for App Attestation on a Global Scale

The recent Pinduoduo hack may have impacted over 700 million users in China, and highlights the need for mobile app attestation to protect against mobile app malware and other vulnerabilities. In the Pinduoduo hack, attackers were able to exploit a vulnerability in the popular ecommerce mobile app to gain access to user accounts and steal sensitive information, such as users' names, phone numbers, and addresses. This type of attack is not uncommon, and highlights the importance of implementing strong security measures, such as app attestation, to help prevent such vulnerabilities from being exploited.

Google Play attestation services can be restricted in China because Google services are generally not accessible within mainland China due to the country's internet censorship policies, commonly referred to as the Great Firewall of China. This can include Google Play Protect, as well as other Google services such as Gmail, Google Maps, and Google Search.

It's worth noting that there are alternative app stores available within China, such as the Tencent App Store and the Huawei AppGallery, which may offer basic attestation services and security measures for mobile apps. Developers who are looking to provide global app and API security, including within China may want to consider implementing alternative security measures that are supported both within the Chinese market, and compatible on a global scale, including both iOS and Android ecosystems.

In addition to the proliferation of new app stores, developers may also choose to take into consideration new operating systems like Huawei HarmonyOS. Harmony is a relatively new operating system, having been launched in 2019, and its popularity is growing. Huawei has announced that it plans to install HarmonyOS on its own devices, including smartphones, tablets, and wearables, as well as on some of its IoT products. The company has also stated that it intends to open up HarmonyOS to other smartphone manufacturers, in an effort to create a more open ecosystem for the operating system.

On the one hand, the growing number of app stores and operating systems may require developers to adapt their app security and attestation strategies to ensure that their apps and APIs are compatible with a wider range of platforms. This may require additional development resources and expertise, as well as a more thorough understanding of the unique security and compliance requirements of each mobile platform.

However, these challenges also create opportunities for innovation and growth in the mobile app attestation space. For example, developers may be able to leverage new app stores and operating systems to reach new audiences and expand their customer base. They may also be able to utilize new attestation strategies and technologies, like runtime secrets, that can adapt to the changing mobile landscape, and that can provide even greater levels of security and compliance assurance for their customers.

In addition, regulatory developments like the recent Competition Commission of India (CCI) rulings against Google Play Services in India, may introduce new challenges for mobile app attestation, but they also create opportunities for both innovation and growth. The recent CCI rulings against Google Play Services are primarily related to issues of anti-competitive behavior, app store policies, and other similar concerns. These rulings are not directly related to app and API security or attestation services. However, the rulings may indirectly impact mobile app developers in the sense that they may lead to changes in the app store policies and other regulations that developers need to follow. If such changes are implemented, they may affect the way developers provide app and API security through attestation services. Developers may need to be more proactive in monitoring and addressing potential security vulnerabilities, and may need to invest in new tools and technologies to ensure that their apps and APIs meet the highest standards of security and compliance.

Overall, while the proliferation of new app stores and operating systems, as well as regulatory developments, may create new challenges for mobile app attestation, they also create opportunities for developers to innovate and grow in this important area. When mobile developers take a global approach to security, the consumer wins and the ecosystem expands. Ignoring the developing economies like China and India, can lead to dangerous API attacks that upset consumers on a worldwide scale.