Misconfigured cloud services exposed 100m Android users’ data
Security researchers have discovered 23 Android applications that potentially exposed over 100 million users’ personal data through various misconfigurations of third party cloud services.
According to Check Point Research, the data exposed from these apps included e-mails, chat messages, location, passwords, and photos. Researchers said this left users exposed to fraud, identity theft, and service swipes (using the same username-password combination on other services).
Researchers said, “there was nothing in place to stop the unauthorised access from happening.”
“Modern cloud-based solutions have become the new standard in the mobile application development world,” researchers said. “Services such as cloud-based storage, real-time databases, notification management, analytics, and more are simply a click away from being integrated into applications. Yet, developers often overlook the security aspect of these services, their configuration, and of course, their content.”
The first problem researchers discovered was the misconfiguration of real-time databases developers used to store data in the cloud and synchronise with connected clients.
In 13 Android apps, whose download numbers range from 10,000 to 10 million, no authentication was in place to prevent hackers from accessing these databases containing e-mail addresses, passwords, private chats, device location, user identifiers, and more.
In one app, T’Leva, a taxi app with over 50,000 downloads, researchers could access chat messages between drivers and passengers. They could also access users’ full names, phone numbers, and locations (destination and pick-up) – all by sending one request to the database.
A second issue was with push notifications.
“Most push notification services require a key (sometimes, more than one) to recognise the identity of the request submitter,” said researchers. “When those keys are just embedded into the application file itself, it is very easy for hackers to take control and gain the ability to send notifications which might contain malicious links or content to all users on behalf of the developer.”
The third problem occurred in cloud storage. In one app, researchers could access cloud storage keys embedded into the app and all stored fax transmissions.
“With just analysing the app, a malicious actor could gain access to any and all documents sent by the 500,000 users who downloaded this application,” said researchers.
Researchers said they approached Google and each app developer before publishing its research to share their findings. Researchers said only a few of the apps have since changed their configurations.
© Dennis Publishing
Professional Development for IT professionals
The mission of the Irish Computer Society is to advance, promote and represent the interests of ICT professionals in Ireland. Membership of the ICS typically reduces courses by 20%. Find out more
Subscribers 0
Fans 0
Followers 0
Followers