En ny rapport från Check Point Research (CPR) visar att bara 23 analyserade appar för Android exponerat data tillhörande hundratals miljoner användare. Apparna är felkonfigurerade och skickar data till olika molntjänster utan eller undermåligt skydd för informationen.

I vissa fall leder apparna till att både användarna som använder dem och de som utvecklar dem exponeras för onödiga risker därför att apparna hanterar data fel.

In this research, CPR outlines how the misuse of real-time database, notification managers, and storage exposed over 100 million users’ personal data (email, passwords, names, etc.) and left corporate resources vulnerable to malicious actors.

Check Point Research (CPR)

Det är också i många fall opersonlig och könslig information som tämligen enkelt kan hamna i helt fel händer.

While investigating the content on the publically available database, we were able to recover a lot of sensitive information including email addresses, passwords, private chats, device location, user identifiers, and more. If a malicious actor gains access these data it could potentially result in service-swipes (ie. trying to use the same username-password combination on other services), fraud, and identity theft.

Check Point Research (CPR)

Molnlagring

Lagring i ett moln är praktiskt, effektivt men genomgången av apparna visar att data lagras oskyddad, lösenord och liknande skickas med i informationen.

Cloud storage on mobile applications is an elegant solution to access files shared by either the developer or the installed application. Let’s take, for example, two apps that we have found on Google Play. With over 10 million downloads, an app named “Screen Recorder” is used to record the device’s screen and store the recordings on a cloud service. While accessing screen recordings through the cloud is a convenient feature, there can be serious implications if the developers embed the secret and access keys to the same service that stores those recordings. With a quick analysis of the application file, we were able to recover the mentioned keys that grant access to each stored recording.

The second app, “iFax”, not only had the cloud storage keys embedded into the app, but also stored all fax transmissions. After analyzing the app, we found a malicious actor could gain access to all documents sent by more than 500k users who downloaded this application.

Check Point Research (CPR)