Tech News, Latest Technology, Mobiles, Laptops

Android app exposed data for millions of users through cloud authentication failure

2

Android app exposed data for millions of users through cloud authentication failure

Researchers analyzing Android apps have discovered serious cloud misconfigurations that lead to potential exposure of data belonging to over 100 million users.

In a report released Thursday by Check Point Research, cybersecurity firms said more than 23 popular mobile apps contained a variety of “third-party cloud service misconfigurations.”

Cloud services are widely used in today’s online services and apps. Probably because of the rapid transition to remote work due to the coronavirus pandemic. While useful for managing, storing, and processing data, you only need to monitor access or authorization once to publish or leak retained records.

Apps, in particular, often integrate with real-time databases to store and sync data across different platforms. However, the developers of some of the apps we investigated were unable to verify that the authentication mechanism was working properly.

According to CPR, the 23 Android apps surveyed (taxi apps, logo makers, screen recorders, fax services, astrology software, etc.) leaked data such as email records, chat messages, location information, user IDs, passwords, images, etc. did.

In 13 cases, sensitive data was exposed in an unsecured cloud setting. Each of these apps accounts for 10-10 million downloads.

For example, while investigating a taxi service app, the team sends one simple request to the app’s database, the message, name, phone number, and boarding and alighting locations sent between the driver and the customer. I was able to pull up both of them.

Cloud services that provide back-end data management for screen recorders and fax apps were also not well protected. By analyzing the application’s files, CPR was able to recover the key to grant access to stored records and fax documents.

Push notification keys can also be found in the app and misused. When the push service is abused, it can be used to send malicious alerts to app users.

According to researchers, these security breaches are due to developers failing to follow “best practices for configuring and integrating third-party cloud services into their applications.”

“This real-time database misconfiguration is nothing new, but [..] The scope of the problem is still too broad, affecting millions of users, “says CPR. “A malicious attacker gaining access to this data can result in a service swipe (a service that attempts to use the same username and password combination as other users), fraud, and theft of personal information. “

CPR notified app developers of misconfigurations prior to disclosure, and some have tightened control.

Earlier this month, researchers announced Qualcomm’s advisory on MSM data services and the discovery of a vulnerability that could theoretically be used to tamper with Android handset modems and insert malicious code. did.

Previous and related coverage


Do you have any hints? Securely contact via WhatsApp | +447713 025 499, or key-based signal: charlie0


Android app exposed data for millions of users through cloud authentication failure

Source link Android app exposed data for millions of users through cloud authentication failure

Comments