Initial situation:
A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the service side.
Problem / Security Threat:
The WebView element of the android and iOS plattforms allow to create a malicious web browser that unveils and modifies session cookies. webView.loadUrl("javascript:document.cookie=’’;");. If the attacker already figured out, how the double submitted cookie looks like, (In this case it's the AuthenticationToken) he is able to create a malicious RESTBrowser. Therefore he adds the already known CSRFToken to the document object model and thus bypasses the CSRF countermeasure. Is that right so far?
Possible Preventions:
So far I have no idea how I can prevent an attacker from creating und publishing such a malicious mobile application, as well to prevent the service from beeing accessed via malicious mobile applications. I know about the existence of the User-Agent header and that the service can use this information to reject requests from others than specific browsers. But I'm sure that also this header can be manipulated within the WebView.
What are effective countermeasures aginst CSRF in contex of malicious mobile applications?
