AfterDawn: Tech news

Android apps flawed - leak personal information

Written by James Delahunty (Google+) @ 22 Oct 2012 18:43 User comments (3)

Android apps flawed - leak personal information Hundreds of apps found to be vulnerable to "man in the middle" attacks.
Research conducted at the University of Leibniz in Hanover and the computer science department at the Philipps University of Marburg, found that hundreds of Android apps can leak personal or sensitive information. The researchers tested 13,500 Android apps from the Google Play store, and found that 8 percent of them failed to protect bank account details, or social media login details, adequately, due to SSL weaknesses.

The test utilized a crafted attack tool and a fake Wi-Fi hotspot to spy on data transmitted from the apps. In many cases, the researchers were able to retrieve login credentials for banking, email, social media or corporate networks. They could also disable security programs or spoof them into labelling secure apps as infected, and in cases could even inject code into the data stream and force apps to carry out specific commands.

Since the researchers intentionally focused on popular apps, some of the tested apps have clocked up millions of downloads.

Read more (PDF): http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf

Previous Next  

3 user comments

122.10.2012 19:21

Snippet from the article regarding apps they tested (in case you don't want to dig...all these had SSL weaknesses):

Amazon MP3 10-50 million
Chrome 0.5-1 million
Dolphin Browser HD 10-50 million
Dropbox 10-50 million
Ebay 10-50 million
Expedia Bookings 0.5-1 million
Facebook Messenger 10-50 million
Facebook 100-500 million
Foursquare 5-10 million
GMail 100-500 million
Google Play Market All Phones
Google+ 10-50 million
Hotmail 5-10 million
Instagram 5-10 million
OfficeSuite Pro 6 1-5 million
PayPal 1-5 million
Yahoo! Messenger 10-50 million
Yahoo! Mail 10-50 million

223.10.2012 0:19

There is an android app you can install on your phone and make a fake wifi hotspot and steal all of someones data that connects through you. I don't remember what it is called.

This message has been edited since its posting. Latest edit was made on 23 Oct 2012 @ 0:20

323.10.2012 0:24

the same may be true for other mobile apps in other mobile OSs, too. the bottomline is that you don't want to use your mobile apps for transactions that needs high security level.


ASUS G73JW | Intel Core i7-740QM, 1.73GHz | 8GB DDR3 | Nvidia GeForce GTX 460M, 1.5GB | OCZ 120GB SSD + Seagate 500GB Hybrid 7200rpm | 17.3" FHD/3D | Blu-ray Write | Win7Pro64

Comments have been disabled for this article.

Latest news

A surprise feature from the world's most popular messaging platform A surprise feature from the world's most popular messaging platform (21 Feb 2017 10:28)
WhatsApp has long ago surpassed SMS in popularity and its billion users is rivaled only by Facebook Messenger, both obviously owned by Facebook. WhatsApp's road to success has really been ....
1 user comment
No taxation without representation unless you're a robot, suggests Bill Gates No taxation without representation unless you're a robot, suggests Bill Gates (20 Feb 2017 13:06)
Bill Gates is obviously known from creating one of the worlds largest technology companies and becoming the richest man on earth for it. Now the previously often even hated CEO of Microsoft ....
1 user comment
Samsung's reputation in free fall after exploding phones Samsung's reputation in free fall after exploding phones (20 Feb 2017 12:34)
Samsung's catastrophic launch of one of last year's most anticipated smartphones had a clear impact on the company's overall reputation, suggests a new report. An annual poll conducted by The ....
1 user comment
Apple's original TV show Planet of the Apps gets a trailer Apple's original TV show Planet of the Apps gets a trailer (15 Feb 2017 12:42)
Apple has positioned itself against some of the biggest TV and movie conglomerates by beginning the production of its own content. Following Netflix's and Amazon's lead, the Cupertino based ....
2 user comments
Cortana reminds you even when you forgot to add the reminder Cortana reminds you even when you forgot to add the reminder (10 Feb 2017 13:22)
Microsoft has announced an update to its voice assistant Cortana with a single new feature. The so-called Commitment feature allows the Windows 10 assistant to remember things you forgot to ....
21 user comments

News archive