ViaForensics: 10 pct of iOS, Android apps store clear text passwords

ViaForensis app data (Aug 2011) — Image used with permission by copyright holder

Almost everyone with a smartphone knows there’s some risk to carrying around apps that handle passwords, email, photos, personal info, and access to financial information on a device that you can easily leave unattended on a desk or sitting on a counter in a coffee shop. But just how many apps put users at risk? According to Chicago-based digital forensics company ViaForensics, a lot: their new Mobile App Security study finds that a full 10 percent of Android and iOS apps tested store passwords as clear text, completely unprotected if anyone should get ahold of a device. Furthermore, some 76 percent of apps tested store usernames in plain text—and while usernames might not seem terribly important to secure, sometimes they’re just the info a criminal or stalker needs to get to more-important info.

“Based on the results of this study, there is a serious potential threat for identity or financial theft if a lost smartphone should fall into the wrong hands,” ViaForensics wrote. “For instance, if a cybercriminal is able to steal one password, coupled with all of the usernames recovered, would pose a serious threat for someone who uses the same password on many accounts.”

ViaForensics rated apps on a three-stage Pass-Warn-Fail system. A “Pass” rating meant that the company couldn’t find sensitive data it was looking for, or if the data was successfully encrypted. ViaForensics gate an app a “Warn” rating if they were able to uncover data but didn’t believe the exposed information put the user at significant risk, while a “Fail” rating meant ViaForensics was able to pull information like passwords and accounts numbers.

Of the 100 apps tested, 39 received a failing grade. Some 44 apps rated a warning, and only 17 got a “pass” rating.

Broken down by category, some 32 financial applications faired relatively well, with 14 passing and 10 receiving a warning: that means eight failed, including Mint for iPhone and Android, along with Wikiinvest and Square for the iPhone. Social networking apps, however, failed miserably, with none receiving a passing mark and a stunning 14 out of 19 failing. Retail apps also faired badly: of 14 apps tested, none passed, 12 for a warning, and 2 failed.

Overall, ViaForensics noted Apple made significant headway with iOS security with iOS 4.0, but notes that iOS users can’t afford to sit back and ignore potential risks from apps.

ViaForensics’ ratings for individual apps are available via their appWatchdog site.

Editors' Recommendations