Home / iPhone / Dozens of popular iPhone apps are still exposing your login details

Dozens of popular iPhone apps are still exposing your login details

(Image: CNET/CBS Interactive)

More than two-dozen popular apps for iPhones and iPads are still leaking sensitive information, such as login details for their services, despite having months to roll out a fix.

Earlier this year, Will Strafach set out to see which popular iPhone apps were vulnerable to man-in-the-middle attacks, which allow attackers to intercept data as it’s being passed from a device to a server.

Strafach, chief executive at Sudo Security Group (verify.ly), surveyed thousands of apps and found dozens that had badly implemented code that allowed the app to accept any certificate to establish an encrypted connection without properly validating it. That means a hacker within close range of a vulnerable device — such as the same Wi-Fi network — could trick the app into accepting a rogue certificate. The app doesn’t know any better, and the hacker can steal your username and password.

Strafach disclosed the names of dozens of low-risk apps, but held off on disclosing the banking and medical apps in order to privately disclose the issue to each app developer.

Time has passed — three months specifically, the standard time in any disclosure process — and while some of the affected apps have been fixed, many have not.

Strafach confirmed that HipChat and Foxit PDF were the only two popular high-risk apps that were vulnerable, but were since fixed.

However, the majority of the rest of the apps were not fixed, and still expose user credentials.

Several banking apps, including Emirates NBD and 21st Century Insurance are still vulnerable to having the customer’s username and password intercepted if the apps were subject to a man-in-the-middle attack.

CERT, the public vulnerability database run by Carnegie Mellon University, said in its disclosures posted Thursday that users of Think Mutual Bank and Space Coast Credit Union, which were also named in Strafach’s list, should “not use affected versions of the application.”

Also included in the list of apps that could expose usernames and passwords if intercepted include Yo, a social networking tool; Diabetes in Check, a blood glucose level checker; and Dolphin Web Browser, which promises the user “private” internet search.

And other apps, such as one that allows Indiana residents to vote, were vulnerable to attacks, said Strafach, though he didn’t conduct extensive testing due to the sensitivity of the app.

Strafach said in a note that the easiest way to limit any issues is to use your phone’s data plan, or not to use the app at all.

Source link

About admin

Check Also

Everything Apple announced at Sept. 15 event: Apple Watch Series 6, SE, Apple One, Fitness Plus, and iPad and iPad Air updates

Apple has announced the Apple Watch Series 6, Apple Watch SE, Apple One services bundles, ...

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.