Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Subscribe
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Subscribe
    Home Applications
    • Applications
    • Cloud
    • Cybersecurity

    Mobile Apps Fail to Secure User Names, Passwords, User Data: Survey

    Written by

    Fahmida Y. Rashid
    Published August 9, 2011
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      Many mobile applications are storing sensitive user account information unencrypted on the mobile device, according to a recent survey of popular smartphone apps.
      The survey included 100 apps spanning multiple categories, including financial management, social networking, productivity and retail, ViaForensics said Aug. 9. The digital security firm tested apps for both Android and iOS devices over an eight-month period with the ViaForensics appWatchdog audit tool.
      The data stored and transmitted can include security credentials, personal financial information, private communications and sensitive company data, researchers wrote. The appWatchdog tool examines what kind of data is being stored on the device. The company has tested other apps before, notably finding flaws in the PayPal app last fall.
      “Smartphone apps handle usernames, passwords and private app data, all of which should be stored securely or not at all. In the event of a lost device or malware infection, data stored insecurely can be compromised,” ViaForensics wrote in the report.
      User names were the most common piece of data that weren’t being protected on the device, according to the survey. About 76 percent of the apps tested stored user names in cleartext on the devices, and 10 percent were doing the same with passwords, ViaForensics found, calling the situation “alarming.”
      “Many systems require only user name and password, so having the username means that 50 percent of the puzzle is solved,” researchers wrote.
      Apps from LinkedIn and Netflix were amongst the ones that did not secure user names. Netflix told ViaForensics in June it will update the app, but the version has yet to be released. In contrast, LinkedIn told Wired.com it was following Android’s standard programming practices and was satisfied with the app’s security.
      App data, or information specifically collected by the application, was second most exposed. Researchers were able to recover app data from 69 percent of the tested apps. Mint.com’s iPhone and Android apps that maintain financial account information stored user transaction history and balance information directly on the phone, and could be recovered easily. The Android version even stored the user’s PIN unencrypted, ViaForensics found.
      ViaForensics found that Apple’s iOS-based apps scored consistently better than the Android counterparts, mirroring the recent analysis from Symantec that iOS has better encryption handling than Android.
      The breakdown by app category type revealed that financial apps were “leading the way” in terms of using encryption and other security measures. In contrast, social networking apps, some of the most popular apps, were also the “least secure” group tested.
      Of the 32 financial apps tested, eight, or 25 percent of the apps failed the tests run by the appWatchdog tool. ViaForensics was able to recover payment history, partial credit card numbers, security PIN, login credentials and other transaction-related data. An additional 10, or 31 percent, of the apps had some user data on the device, but it did not pose a significant risk.
      None of the 19 social network apps passed the username test as they all stored the login names in plaintext. None of them passed the app data test, either, as some data, such as instant messaging logs, direct messages and passwords, was stored without any encryption on the device.
      ViaForensics tested productivity apps and found them lacking in security as well. Of the 35 apps, only three passed all the tests. Even more worrying, researchers were able to recover the security question and answer required to access delivered emails from an app that was described as a “secure email service,” researchers wrote.
      None of the retail apps passed the tests, researchers found to their surprise. “Consumers certainly expect that retailers providing mobile apps handle such data [such as credit card information] with the highest security,” researchers wrote.
      Most apps were insecurely storing search history and customer information such as name and address on the device. The Groupon app for Android failed because researchers were able to recover the password.
      If a lost smartphone fell into the wrong hands, “there is a serious potential threat for identity or financial theft,” ViaForensics researchers concluded. A cyber-criminal who recovered all the usernames and found one password would be a “serious threat for someone who uses the same password on many accounts.”

      Fahmida Y. Rashid
      Fahmida Y. Rashid

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.