Just a Handful of Android Apps Exposed Data of More than 100 Million Users (therecord.media) 21
Almost half a decade after the first reports were published, mobile app developers are still exposing their users' personal information through abhorrently simple misconfigurations. From a report: In a report published last week, security firm Check Point said it found 23 Android applications that exposed the personal data of more than 100 million users through a variety of misconfigurations of third-party cloud services. This included developers who forgot to password-protect their backend databases and developers who left access tokens/keys inside their mobile application's source code for services such as cloud storage or push notifications. The Check Point team said it was able to use the information they found through a routine examination of 23 random applications and access the backend databases of 13 apps. In the exposed databases, researchers said they found information such as email addresses, passwords, private chats, location coordinates, user identifiers, screen recordings, social media credentials, and personal images.
I'd like to know the apps (Score:4, Insightful)
Re:I'd like to know the apps (Score:4, Informative)
I RTFA and Checkpoint only mentioned 5 of the apps, none of which I use. Be nice to know the other apps.
For the all the ther /. readers who didn't bother reading the article:
Unfortunately, Check Point only shared the names of five of the 23 apps that exposed information through their backends—Logo Maker, Astro Guru, T’Leva, Screen Recorder, and iFax.
Perhaps Google needs to review the Apps better (Score:1)
While a good part of Apple acceptance or rejection of Apps into its App store, is based on Anti-Competitive actions, it also gives the user safer applications. Considering that iOS is about 13 years old now, widely popular and highly used, by people of all ages and IT skill levels. We haven't had any huge problem with Apple apps that exposed a large number of people, or had some massive hacks.
Granted it is much like how a Gated Community can say how much lower its crime rate is. Not because of better poli
Re: Perhaps Google needs to review the Apps better (Score:4, Insightful)
Something tells me this is an iOS problem as well, though iOS being notoriously difficult to audit makes it less likely that a third party would be able to spot something like this. Apple is already well known to let outright scammy apps through their censors, something tells me that a misconfigured cloud storage, especially one apple has zero control of, would fly right past their censors.
Re: (Score:2)
This particular story reports on security researchers who only looked at Android apps. But there have been plenty of stories in the past about security researchers who looked at iOS apps and found very similar problems. And see, for example, this from earlier this month [slashdot.org]:
Bullshit, Apple Will Be No Better (Score:4, Interesting)
Shitty Title (Score:3)
Re: Laughs in iOS (Score:1)
They will protect you.
Just stay under the hen, liddle chick.
Just a few apps (Score:2)
"Just a handful of Android apps exposed data."
Sounds less alarmist, eh?
Re: (Score:2)
Too Many F#@kin Apps Maybe? (Score:2)
Re: Too Many F#@kin Apps Maybe? (Score:2)
The bigger problem is the search algos for both Google and Apple promote actively developed and downloaded apps. So, new shit gets put in your face, which is nice sometimes. As well as well-supported apps with lots of users driving active development, which is also usually good. And stuff people download a lot is maybe popular and good.
But they also promote buggy software that needs updates over software that worked fine in 2011 and still works fine. It promotes pay-to-play downloads over software that's be
Back-end databases? (Score:2)
"This included developers who forgot to password-protect their backend databases"
There are two mistakes here: in addition to not password protecting their databases, the databases should not be accessible from the Internet.
Re: Back-end databases? (Score:3)
Meh. Private certs and strong passwords do good work.
Re: (Score:2)
Defense in depth.
There is no reason to expose the database to the Internet. Any exposure is risk. What if a zero-day vulnerability is found in the database software?
Re: Back-end databases? (Score:2)
Well, if the zero day requires a TLS handshake, you're covered already. In essence, there already is layered security. More layers are better until they're not.
The DB software is likely more secure than your web app front-end that has access to the DB. It all depends on what you're trying to do.
Everything has its place. It's true most people who put DBs on the Internet do it because it's easier, and those people aren't going to spend the time solving the certificate and creds distribution problem. But if th
Outsider apps = inherent weakness (Score:2)
The world doesn't need millions (literally) of applications more than it needs security.
If AAPL were serious about security they'd block all software Apple or actual partners do not produce and make a proper walled garden that locks out outsiders, ALL of them.
Android is hopeless from a security perspective because and should be left to those who resent security. Understanding what one cannot have is important to making informed choices.
Clueful users would be best served by pure FOSS phones but there won't b
"App" rhymes with "crap" (Score:2)
And that is no mistake. The whole idea was from the start that semi-competent and incompetent people would write tons of apps. Some would appear to be well-written and hence be actually used. The problem in the story is just a completely predictable side-effect.