Popular apps riddled with flaws

By

Authentication bypass, SQLi and clear text data.

A survey of popular applications has revealed that most have SQL flaws, store sensitive details in an unencrypted format and have fragile backends.

Popular apps riddled with flaws

The IntegriCell survey of popular Apple and Android applications found 35 percent had SQL injection flaws, and 99 percent had unencrypted data.

Each app contained a backend API and many used SQLight.

All applications had a remotely-exploitable web sever and patch configuration flaw while 79 percent had an authentication bypass. 

Unencrypted data was also present in 99 per cent of application backends.

“I pointed the scanning tool at the application backend and did a simple scan and as they were default Linux builds, I did the configuration and all of the administrator passwords were not changed,” IntegriCell president Aaron Turner said.

“This is an issue of the lack of maturity of mobile application developers who are ‘not solving stupid'.

"Look at the eco-system; once the backend has been attacked an attacker can use JSON to control the frontend also.”

This article originally appeared at scmagazineuk.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, UK edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

Log In

  |  Forgot your password?