Developers of mobile travel applications are more focused on features that boost the user experience than on ensuring increased security for their programs and customer data, a recent report from Bluebox Security reveals.
According to the mobile security company, even the top 10 most popular mobile travel apps lack proper security, and all of the analyzed programs include critical flaws. The issues impact applications designed for popular mobile platforms including Android and iOS.
The firm notes that many developers have created numerous points of entry for attackers to access sensitive data by overlooking the security of their apps.
In their analysis, Bluebox researchers found that only one in ten Android travel apps encrypts data stored on mobile devices, leaving data such as usernames, passwords, e-mail and server addresses, and credit card numbers easily accessible to attackers. None of the ten iOS programs examined leveraged encryption of stored data.
The study also uncovered that certificate pinning was present in only two of the ten Android apps and in one of the ten iOS programs and that it was used only on a portion of the network connection. Thus, the rest of the examined software left users vulnerable to man-in-the-middle attacks that can leak data in transit.
Additionally, four of the examined Android apps and six of the iOS apps included code that could offer admin functionality and could result in granting special privileges that regular users should not have access to. Attackers could exploit this to access credit card information, travel history, upcoming travel plans, and other similar data, Bluebox said.
None of the examined Android and iOS applications incorporated anti‐tampering measures, which could allow attackers activate restricted functionality and gain full control of the programs and to modify the app to include malicious code or to launch attacks on other apps. None of the apps included sufficient device integrity (jailbreak/root detection) protections.
API keys that offer access to third-party services were not hidden in 9 of the examined apps on both Android and iOS, allowing attackers to extract and use them to connect to these services disguised as developers, thus receiving access to sensitive information.
The report also shows that vendors have created, on average, only 30 percent of the app code and that the remaining 70 percent of code represented third-party components, representing potential attack points and security blind spots for developers.
Bluebox advises enterprise security teams to implement data encryption for all app data, to remove code that is not needed for the program’s functionality, adding “self-defending” capabilities to mobile apps to ensure data protection, and consider security as part of the development and update process from the beginning.
“All of the apps we reviewed could be modified and changed to act in ways other than what the developers intended, putting sensitive information at risk regardless of device,” said Andrew Blaich, lead security analyst at Bluebox Security. “Data must be protected at the application level and security should be integrated into the development process. Without it, users – enterprise employees and consumers alike – could suffer damaging loss of important and personal information.”
Travel apps are far from alone in being the only category of apps that put user and enterprise data at risk.
Earlier this year, IBM’s Application Security Research Team conducted a study of 41 popular dating applications for Android and determined that more than 60 percent of them are potentially vulnerable to cyberattacks. Additionally, a recent study found that popular gambling apps include significant security flaws.
“Mobile applications can pose serious risk to enterprise data, customers and security in general, so it is especially important for organizations to be able to identify these apps,” Adam Ely, Founder and COO of Bluebox, wrote in a 2014 SecurityWeek column.
“We know that attackers follow users and the popularity of mobile apps in conjunction with the emergence of their security flaws means that mobile is prime to be the next attack vector that threatens corporate data and user privacy,” Ely wrote in a SecurityWeek column earlier this month.
“Applying a zero trust model to mobile and the right security controls at the app level could align productivity and security,” he said. “But the bottom line is that it’s no longer about the device; it’s about the applications.”
