Popular apps riddled with flaws

A survey of popular applications has revealed that most have SQL flaws, store sensitive details in an unencrypted format and have fragile backends.

The IntegriCell survey of popular Apple and Android applications found 35 percent had SQL injection flaws, and 99 percent had unencrypted data.

Each app contained a backend API and many used SQLight.

All applications had a remotely-exploitable web sever and patch configuration flaw while 79 percent had an authentication bypass. 

Unencrypted data was also present in 99 per cent of application backends.

“I pointed the scanning tool at the application backend and did a simple scan and as they were default Linux builds, I did the configuration and all of the administrator passwords were not changed,” IntegriCell president Aaron Turner said.

“This is an issue of the lack of maturity of mobile application developers who are ‘not solving stupid'.

"Look at the eco-system; once the backend has been attacked an attacker can use JSON to control the frontend also.”

This article originally appeared at scmagazineuk.com