Mobile Apps Exposing Personal Data of Millions of Users

What has been discovered?

• Personal data such as emails, location data, chat messages, photos, and passwords, was publicly available online.
• The exposed information belongs to real-time databases that allow application developers to save data on the cloud. However, there was no authentication check to access them.
• The mobile apps were identified as Astro Guru, T’Leva, Screen Recorder, and iFax, among others. Although these utility apps perform the tasks they are meant to, they inadvertently ended up exposing user data.
• If a malicious actor gains access to such data, it could lead to service swipes, along with fraud and identity theft.

Unprotected push notifications

• Most push notification services need single or multiple keys to recognize the identity of the request submitter and sometimes, these keys are just added inside the application file itself.
• This makes it very easy for cybercriminals to take control and send notifications that could include malicious links or content to all users that appear to be sent by the developer.

Conclusion