Sloppy mobile apps are making the news for introducing security risks in their code.
What’s a “sloppy app”? Just this month, we wrote about the risks that arise from mobile app code that doesn't follow security protocols and creates vulnerabilities that attackers can exploit.
This week Elizabeth Montalbano reported in Dark Reading that researchers at Symantec found several popular Android and iOS apps containing cloud services credentials, such as Azure Blob Storage, AWS, and Twilio, in *plain text* in their code.
Quokka’s app intelligence solutions found those and additional coding issues such as hard-coded initialization vectors used in encryption, vulnerabilities to SQL injection attacks, and Webviews that allow access to local files
In the wrong hands, these security risks created by sloppy coding can be exploited to exfiltrate sensitive data, putting enterprise and customer data at risk.
For example, our automated analysis found that the app for tinnitus relief mentioned in the research, not only contains hard-coded cloud storage credentials for managing various assets and sound files, but also several other high risk issues. This could lead to unauthorized access and data breaches. And if this app is on mobile devices used for work, the exploit could compromise enterprise information.
Given the rise of such apps in the app stores, we recommend enterprises use a proactive app vetting solution to ensure apps used in their workforce don't have such vulnerabilities.
For more about sloppy apps and how Quokka’s Contextual Mobile Security Intelligence solutions can help you protect your organization, read more at the link in comments.
https://lnkd.in/eiV-KHxH
