A dozen Android apps exposed data of 100M+ users

Check Point researchers found 23 Android apps that exposed the personal data of more than 100 million users.

Security researchers from Check Point have discovered 23 Android applications that exposed the personal data of more than 100 million users due to misconfigurations of third-party cloud services.

The experts pointed out that the misconfiguration also expose developer’s internal resources, such as access to update mechanisms and storage, at risk.

“This misconfiguration of real-time databases is not new, but to our surprise, the scope of the issue is still far too broad and affects millions of users.” reads the report published by the experts. “While investigating the content on the publically available database, we were able to recover a lot of sensitive information including email addresses, passwords, private chats, device location, user identifiers, and more. If a malicious actor gains access these data it could potentially result in service-swipes (ie. trying to use the same username-password combination on other services), fraud, and identity theft.”

Check Point experts were able to access the backend databases of 13 apps (i.e. Logo Maker, Astro Guru, T’Leva, Screen Recorder, and iFax) that were found to contain sensitive information such as email addresses, passwords, personal images, private chats, location coordinates, user identifiers, social media credentials, screen recordings.

In some cases, the apps analyzed by Check Point exposed access keys that would have allowed attackers to send push notifications to all the users of the applications.

Threat actors could abuse push notification services to conduct malicious activities, such as sending out messages containing links to malicious websites set up to deliver malware or phishing sites.

Experts explained that Cloud storage on mobile applications is often used to access files shared by either the developer or the installed application.

One of the apps analyzed by the experts, named Screen Recorder, which is available on Google Play with over 10 million downloads was storing the device’s screen on a cloud service. The researchers discovered that was possible to access the cloud storage keys that allowed them to access to users’ screenshots from the device.

“While accessing screen recordings through the cloud is a convenient feature, there can be serious implications if the developers embed the secret and access keys to the same service that stores those recordings. With a quick analysis of the application file, we were able to recover the mentioned keys that grant access to each stored recording.” continues the report.

Below the full list of apps analyzed by the experts, a dozen of them have more than 10 million installations on Google Play and the majority exposes an unprotected database.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Android apps)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.