Top Android and iOS apps used by millions could shed unencrypted cloud logins
AWS and Azure keys found unecrypted
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A number of popular Android and iOS mobile apps boasting millions of users carried a major vulnerability that could have been used to leak sensitive user data.
A report from cybersecurity researchers at Symantec found the problem is nothing more than software developers not paying enough attention at work.
The researchers discovered eight apps, on offer viaGoogle Playand the App Store, that contained hardcoded, unencrypted credentials for cloud services. On these services, the apps stored sensitive user information, so, in theory, should a malicious actor obtain the binaries, or source codes, of any of these apps, they could easily exfiltrate people’s information and thus put them in harm’s way.
Thousands of compromised websites
On Android, the apps were The Pic Stitch (a collage-editing app for Android with more than five million users), Meru Cabs (a taxi-hailing app with more than five million users), Sulekha Business-List & grow (500K+ downloads), ReSound Tinnitus Relief (500,000 users), Saludsa (100,000+ users), Chola Ms Break In (100,000 users), EatSleepRIDE Motorcycle GPS (100,000 users), and Beltone Tinnitus Calmer (100,000 users).
Appledoes not share iOS app download figures, however, there are app store ratings, which can be used to determine, at least in part, the number of downloads. Therefore, we have Crumbl (a desert-ordering app with 4.3 million ratings), Eureka (a survey app with more than 400,000 ratings), Videoshop (350K ratings), Solitaire Clash: Win Real Cash (240,000 ratings), and Zap Surveys - Earn Easy Money (235,000 ratings).
There is not much end-users can do here, since this is a problem with the app itself, and something the developers could have easily remedied. Still, Symantec recommends installing anantivirus programand only downloading apps from reputable sources (such as, ahem, Google Play Store, or the Apple Store).
ViaThe Register
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A critical Palo Alto Networks bug is being hit by cyberattacks, so patch now
3 reasons why PIA fell in our best VPN rankings
‘That was never the plan’: Arcane creators dismiss claims that the hit Netflix show was going to run for five seasons
