Popular apps riddled with flaws

By

Authentication bypass, SQLi and clear text data.

A survey of popular applications has revealed that most have SQL flaws, store sensitive details in an unencrypted format and have fragile backends.

Popular apps riddled with flaws

The IntegriCell survey of popular Apple and Android applications found 35 percent had SQL injection flaws, and 99 percent had unencrypted data.

Each app contained a backend API and many used SQLight.

All applications had a remotely-exploitable web sever and patch configuration flaw while 79 percent had an authentication bypass. 

Unencrypted data was also present in 99 per cent of application backends.

“I pointed the scanning tool at the application backend and did a simple scan and as they were default Linux builds, I did the configuration and all of the administrator passwords were not changed,” IntegriCell president Aaron Turner said.

“This is an issue of the lack of maturity of mobile application developers who are ‘not solving stupid'.

"Look at the eco-system; once the backend has been attacked an attacker can use JSON to control the frontend also.”

This article originally appeared at scmagazineuk.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, UK edition
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Log In

  |  Forgot your password?