Major Android and iOS apps used by millions could remove unencrypted cloud logins

A number of popular Android and iOS mobile apps with millions of users had a major vulnerability that could have been used to leak sensitive user data.

A report by Symantec cybersecurity researchers found that the problem is nothing more than software developers not paying enough attention to their work.

The researchers discovered eight apps, offered on Google Play and the App Store, that contained encrypted and unencrypted credentials for cloud services. In these services, the applications stored sensitive user information, so in theory, if a malicious actor obtained the binaries, or source codes, of any of these applications, they could easily exfiltrate people’s information and , therefore, putting them in danger.

Thousands of compromised websites

On Android, the apps were The Pic Stitch (a collage editing app for Android with over five million users), Meru Cabs (a taxi ride app with over five million users), Sulekha Business-List & grow (+ 500,000 downloads). ), ReSound Tinnitus Relief (500,000 users), Saludsa (100,000+ users), Chola Ms Break In (100,000 users), EatSleepRIDE Motorcycle GPS (100,000 users) and Beltone Tinnitus Calmer (100,000 users).

Apple doesn’t share iOS app download figures, but there are app store ratings, which can be used to determine, at least in part, the number of downloads. So we have Crumbl (a desert ordering app with 4.3 million ratings), Eureka (a survey app with over 400,000 ratings), Videoshop (350,000 ratings), Solitaire Clash: Win Real Cash (240,000 ratings ) and Zap Surveys – Earn Easy Money (235,000 ratings).

There isn’t much that end users can do here, as this is an issue with the app itself and something that the developers could have easily fixed. Still, Symantec recommends installing an antivirus program and only downloading apps from reputable sources (like, ahem, the Google Play Store or the Apple Store).

road The Register

Related Posts

Kamala Harris refuses to say what she would have done differently with Biden, citing the vice president’s “tradition.”

New Windows 11-Features: Microsoft published Vorschau-Updates

Netflix-Komödie “No one wants this” – eine wahre Liebesgeschichte | Unterhaltung