Η Check Point Research (CPR) discovered sensitive data in mobile applications unprotected and available to anyone with a Browser.
Ψpointing to “VirusTotal", the CPR he found 2.113 mobile applications, whose databases in cloud were unprotected and exposed, all during a three-month research study. Mobile applications ranged from 10.000+ downloads up to 10.000.000+ downloads.
Η Check Point Research (CPR) found that the sensitive data of a range of mobile applications was exposed and available to anyone with a browser. The VirusTotal, an affiliate of Google, is a free online tool that analyzes files and URLs to detect viruses, trojans and other forms of malware.
The sensitive data found exposed by CPR included: personal family photos, coupon IDs in a healthcare app, data from cryptocurrency exchange platforms And much more. CPR provides several examples of applications whose data were found exposed.
In one of them, CPR found exposed more than 50.000 private messages from a popular dating app. THE CPR warns of how easily data breach can occur through the method described and what cloud security developers can do to better protect their applications. In order to avoid exploitation, CPR will not currently list the names of the mobile applications involved in the investigation.
Access Methodology
For accessing exposed databases, the methodology is simple:
- Search for mobile applications that communicate with cloud services at VirusTotal
- Archive those that have direct access to data
- Browse the link you received
Comment: Lotem Finkelsteen, Head of Threat Intelligence and Research at Check Point Software:
A hacker may ask VirusTotal the full path to the cloud backend of a mobile application. We ourselves share some examples of what we could find there. Everything we found is available to anyone. Finally, with this research we prove how easy it is for a data breach or exploitation to occur.
The amount of data that is open and available to anyone in the cloud is insane. It is much easier to break than we think.
How to stay safe:
Here are some tips to ensure your various cloud services are secure:
Amazon Web Services
AWS CloudGuard S3 Bucket Security
Specific rule: “Ensure S3 buckets are not publicly accessible” Rule ID: D9.AWS.NET.06
Specific rule: "Make sure S3 buckets are not accessible to the general public." Rule ID: D9.AWS.NET.06
Google Cloud Platform
Ensure that Cloud Storage DB is not anonymously or publicly accessible Rule ID: D9.GCP.IAM.09
Make sure the cloud storage database is not anonymous or publicly accessible Rule ID: D9.GCP.IAM.09
Microsoft Azure
Ensure default network access rule for Storage Accounts is set to deny Rule ID: D9.AZU.NET.24
Make sure the default network access rule for storage accounts is set to deny Rule ID D9.AZU.NET.24
Press Release
Do not forget to follow it Xiaomi-miui.gr on Google News to be informed immediately about all our new articles! You can also if you use RSS reader, add our page to your list by simply following this link >> https://news.xiaomi-miui.gr/feed/gn
