Downed Clueful app reveals encryption woes

Bitdefender's Clueful security app pulled last month from the Apple App Store has found 41 per cent of iOS applications are able to access a user's location and a third store unencrypted data.

A study of more than 65,000 applications on the Apple App Store revealed tens of thousands tap contact information and access data without explicit user permission. The research also found that 18 per cent of the apps can access a user's address book.

The research was derived from analysis of the company's Clueful app, which was taken down by Apple from its App Store on 30 June. The app determined what information applications had sought and compiled its database from user-submitted apps.

Bitdefender chief security researcher Catalin Cosoi said while many apps use these privileges to function, others have no obvious use for the data they may be collecting.

"It is worrying that stored data encryption on iOS apps is low and location tracking is so prevalent," he said.

"Without notification of what an app accesses, it is difficult to control what information users give up. We see a worrying landscape of poor user data encryption, prevalent location tracking and silent unjustified address book access."

Apple did not say why the app was taken down and gagged Bitdefender under a non-disclosure agreement from doing the same, Security Week reported.

BitDefender's Clueful analysis service was still active for users and the security vendor was working on getting the application back online.

SC has found duplicates of the app mirrored online which can be installed on jailbroken Apple devices, however the security of those files cannot be verified and users are warned they could be laced with malicious code.

- With Darren Pauli

Copyright © SC Magazine, Australia