Top Android and iOS apps used by millions could shed unencrypted cloud logins

Digital clouds against a blue background.
(Image credit: Shutterstock / Blackboard)

A number of popular Android and iOS mobile apps boasting millions of users carried a major vulnerability that could have been used to leak sensitive user data.

A report from cybersecurity researchers at Symantec found the problem is nothing more than software developers not paying enough attention at work.

The researchers discovered eight apps, on offer via Google Play and the App Store, that contained hardcoded, unencrypted credentials for cloud services. On these services, the apps stored sensitive user information, so, in theory, should a malicious actor obtain the binaries, or source codes, of any of these apps, they could easily exfiltrate people’s information and thus put them in harm’s way.

Thousands of compromised websites

On Android, the apps were The Pic Stitch (a collage-editing app for Android with more than five million users), Meru Cabs (a taxi-hailing app with more than five million users), Sulekha Business-List & grow (500K+ downloads), ReSound Tinnitus Relief (500,000 users), Saludsa (100,000+ users), Chola Ms Break In (100,000 users), EatSleepRIDE Motorcycle GPS (100,000 users), and Beltone Tinnitus Calmer (100,000 users).

Apple does not share iOS app download figures, however, there are app store ratings, which can be used to determine, at least in part, the number of downloads. Therefore, we have Crumbl (a desert-ordering app with 4.3 million ratings), Eureka (a survey app with more than 400,000 ratings), Videoshop (350K ratings), Solitaire Clash: Win Real Cash (240,000 ratings), and Zap Surveys - Earn Easy Money (235,000 ratings).

There is not much end-users can do here, since this is a problem with the app itself, and something the developers could have easily remedied. Still, Symantec recommends installing an antivirus program and only downloading apps from reputable sources (such as, ahem, Google Play Store, or the Apple Store).

Via The Register

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A close-up photo of an iPhone, with the App Store icon prominent in the center of the image.
Thousands of iOS apps found to expose user data
Stalkerware
New spyware found to be snooping on thousands of Android and iOS users
An Android phone being held in the hand
These malicious Android apps were installed over 60 million times - here's how to stay safe
Kaspersky Report on Stalkerware
Security flaw in popular stalkerware apps is exposing phone data of millions
Android phone malware
Screen reading malware found in iOS app stores for first time - and it might steal your cryptocurrency
A close-up photo of an iPhone, with the App Store icon prominent in the center of the image.
App stores are increasingly becoming a major security worry
Latest in Security
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
UK Prime Minister Sir Kier Starmer
The UK releases timeline for migration to post-quantum cryptography
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
Latest in News
Ray-Ban Meta Smart Glasses
Samsung's rumored smart specs may be launching before the end of 2025
Apple iPhone 16 Review
The latest iPhone 18 leak hints at a major chipset upgrade for all four models
Quordle on a smartphone held in a hand
Quordle hints and answers for Monday, March 24 (game #1155)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Monday, March 24 (game #386)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Monday, March 24 (game #652)
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 23 (game #1154)