Security News > 2021 > May > 100M Android Users Hit By Rampant Cloud Leaks

More than 100 million Android users are at risk after 23 different mobile apps were found to leak personal data in the wake of rampant cloud misconfigurations.

In the case of at least two of the apps, cloud keys were exposed with no safeguards, according to the researchers.

The Screen Recorder app does what it says - it records the user's screen and then saves the recordings in the cloud for later access.

"Compiled code within mobile app binaries is much more readable than many developers realize. Decompilers and dissassemblers are plentiful, and such connection keys are easily harvested by attackers. Attackers then bypass the app entirely and connect directly to backend APIs to abuse the business logic of the app or scrape data."

Mobile app developers should make use of the Android Keystore and Keychain mechanisms that are backed by the hardware security module of the mobile device.

"With just analyzing the app, a malicious actor could gain access to any and all documents sent by the 500,000 users who downloaded this application," according to Check Point - a problem given that the heaviest users of faxes these days are regulated industries like healthcare and financial companies.

News URL

https://threatpost.com/100m-android-users-cloud-leaks/166372/