Android application misconfigured in the cloud, causing data leakage of hundreds of millions of users
Cybersecurity company Check Point published a report on Thursday. In this report, Check Point stated that at least 23 popular Android applications contain various misconfigurations of third-party cloud services. These serious cloud service misconfigurations have caused the personal data of more than 100 million users to be leaked.
Cloud services are now widely used by various online services and applications, and under the influence of the epidemic, people working and studying remotely have also prompted cloud services to be used more frequently. Cloud services are very effective in data management, storage, and processing, but as long as there is negligence in access or authorization, it may cause the leakage of various stored data.
Today’s applications usually integrate with real-time databases to store and synchronize data from different platforms. However, a report by Check Point shows that there are many popular application developers who fail to ensure that the cloud service authentication mechanism is accurately configured.
The report shows that these 23 Android applications cover ride-hailing applications, design software, screen recording tools, fax services, and astronomy software which cause personal data leaks. The leaked data includes email records, communication information, location information, user IDs, passwords, and images.
Of these applications, 13 apps are sensitive data that can be publicly accessed under insecure cloud settings. The downloads of these applications are between 10,000 and 10 million.
Check Point said: “This misconfiguration of real-time databases is not new, but to our surprise, the scope of the issue is still far too broad and affects millions of users. All our researchers had to do was attempt to access the data. There was nothing in place to stop the unauthorized access from being processed.”
Prior to disclosing these problems, Check Point had notified the application developers of these misconfigurations, and some of them had launched new versions to enhance security.
