Millions of Android and iOS users at risk from hardcoded creds in popular apps

An analysis of widely used mobile apps offered on Google Play and the Apple App Store has found hardcoded and unencrypted cloud service credentials, exposing millions of users to major security problems. The problem stems from lazy coding, according to Yuanjing Guo and Tommy Dong, a pair of software engineers at Symantec's …

[Anonymous Coward]

Not *that* surprising

Annoying, yes, surprising, not really.

What we'd call 'lazy' is what your average MBA would call 'efficient' - why "waste" more manhours?

Thankfully there are plenty who DO take the time, and I thank them for their effort by using their service or application (an yes, pay for it - because effort costs money).

[Richard 12]

Re: Not *that* surprising

It happens because there are so few good examples. The big players barely document anything at all - Apple is possibly the worst with their "list of function names" masquerading as documentation, but the rest are crowding close behind.

Do a search, and almost every example is incomplete or wrong.

So even a diligent dev is unlikely to get it right, while their manager leans on them to ship something, anything.

And of course, Copilot was trained on outdated broken examples, and spews out a more broken version.

An LLM-using junior dev has no idea how any of it works, or any indication as to where the snippet came from, and so can only fix the compilation errors.

And thus more bad examples come into being.

[Anonymous Coward]

Re: Not *that* surprising

I've just spent a week trying to get PowerShell to connect to SharePoint and do something useful. It's all PowerShell warning messages saying do it some other way as it's better, skeleton documentation from Microsoft which conflicts with the warning messages, constantly deprecated features, a moving target that is SharePoint online, half-baked examples around the Internet, and AI-generated slop that is just made-up shit. I've given up, it's pointless. It's easier just to do it manually.

After reading the previous post, I just needed to get that off my chest. Thank you for your patience.

[katrinab]

"Symantec recommends users install a third-party security system to block any of the consequences of these coding errors, and – surprise, surprise – it has one for the purpose. Users should also be very wary of whatever permissions their apps ask for and only install apps from trusted sources."

Surely the risk is not having the credentials per se, but the fact that everyone else can download the app, get the credentials, and get access to your data?

[hoola]

Odd how Symantec recommend the solution being to install a security product they happen to sell.

My experience of Symantec is they are a long way down the list of people I would remotely consider doing business with or installing one of their products.,

[Cris E]

That's why Symantec is spending the time and money to show how bad everyone else is. You may not think better of them, but they can move closer to the middle of the pack if they throw enough other vendors under the bus.

[GoneFission]

Oh no, someone might be able to access all of this user data without first paying the company for it. Good thing the consequence for hemorrhaging people's data is a fine and a sternly worded letter, that will surely disincentivize careless practices such as this from causing real economic damage.

[fromxyzzy]

Don't forget the check you get in the mail three years later for 5 units of currency and a free 12-month subscription to 'dark web monitoring'.

[FrogsAndChips]

It's not just the data leaks that the company should be worried about. Depending on the privileges associated with the credentials, this could lead to a complete takeover of the AWS/Azure account (think data deletion, ransomware, cryptomining, spam sending...).

[Anonymous Coward]

Passwords

What are these password things you talk of.

Don't use them and it's even more efficient code

[benderama]

Thought it was gonna be important apps we all have. Not by the sound of the examples listed!

[MachDiamond]

I can do that without an app!

As part of a dying breed, I can do lots of things without an app and regularly do so. I get bombarded by companies that want me to load their app and I find that I can do just as well or even better by not opening a new channel for advertisers to show me more ads and harvest more information about me.

Let's see, I have an app to:

Keep lists of what I need at the store (food, hardware, auto parts). No more managing bits of paper

Calculate photos settings (I don't use it very often)

track the sun, which I do use when making photos

remote control my camera. A backup for the app on my tablet.

fly my drone. Again, a backup for the tablet

monitor the car. Torque pro, but the new android head unit does that job now

and that's about it. I've got nice big computer screen to do stuff at home and when I'm out, I'm not neck deep in my phone, I'm doing something or I'd be home where snacks and beers are super cheap. I also get to control the music choices.

[tiggity]

Re: I can do that without an app!

@MachDiamond

"Let's see, I have an app to:

Keep lists of what I need at the store (food, hardware, auto parts). No more managing bits of paper"

Is it that difficult to have a piece of paper in your pocket?

My shopping list manages fine on paper (a bit of IT involved as have a typical "weekly big shop" document* & print that out, crossing out with a pen stuff not needed that week)

That way when I go to the shop I have zero need to look at a phone (& no phone visible means no way for local low level crims to clock my phone & try and nab it as a change from shoplifting)

* Yes, the lists is as geeky as you would expect based on the several shops I typically visit for a weekly shop, products ordered on list based on visiting shops in a most efficient order, and for each shop ordered so that it is an optimal route in the shop, no doubling back to revisit aisles**

** No issues with the small shops such as greengrocers, deli etc, but stuff I get from supermarkets is a pain as they keep changing layout far too frequently for my liking so I periodically have to edit the product order for those items that are supermarket only as old route becomes sub optimal with layout changes.

[MachDiamond]

Re: I can do that without an app!

"Is it that difficult to have a piece of paper in your pocket?"

Yes..... and no. If I'm just heading over to the hardware store for a few things, I'll often have my list on a piece of paper. Where the list on the phone comes in handy is when I see I'm running low on something such as sugar. I put it on the list. The same goes for hardware bits and bobs. It's the things I'll buy the next time I'm at the store so I don't forget and have to drive miles if I really need it. I nearly always will have the phone with me since I work in the field which means that bit of paper with my shopping list won't be left stuck to the fridge. It works for me, maybe it will work for others to do it the same way. I could do without a list on the phone. I could even do without the phone, but I expect my customers aren't going to go the same way and if they can't call me, they'll will call somebody else.

Since I'm in the field about half the time for work, if I happen to be near a store that has something I need, I can stop and buy it and see if there is anything else I can get at the same time. Much of the time, it's hardware. I always have projects in mind and I try to keep a stock of things I use all of the time such as screws. If I use up what I have, I like to get more before I need them again so it's not a special trip to the local store where they can be much more expensive if they are in stock. Some projects need items from a commercial supply shop so it makes sense to me to visit them when I'm in the area even if that project isn't top priority. There are also times when I need a truck so if I have one for a job, I'll look at my lists to see if I can piggyback things I need for the house.

My approach is really one of having a think if a computer/software approach is adding any value. If I have to trade privacy to get rid of a paper list, no, I don't see value in that. If I'm not trading privacy AND it's making sure that when I'm at the warehouse grocery 45 miles away I get everything I need, the added efficiency does have value for me.

If somebody nicks my phone, they'll find it wasn't worth the effort. I don't do anything financial or personally sensitive on it, it won't call Nigeria and the phone itself is worth less than $100 (currently a gen or two back Nokia). It would be a giant PIA, but not crushing. I haven't heard of anybody nicking a phone directly from somebody in a supermarket. The latest iPhone might be a target, but that's not anything I'd own.

[barravince]

They could have been more original

NeXT was already used by the variant of UNIX that Steve Jobs assembled in the eighties. Surely another name could have been found...

[Plest]

This is why I do not have many apps on my phone, most certainly no financially related ones! I have an MP3 player, the train timestables, my drone software and whatsapp so the kids can reach me, nothing else.

[MachDiamond]

"and whatsapp so the kids can reach me"

You don't let them have your phone number?