{"id":57491,"date":"2024-10-23T14:13:11","date_gmt":"2024-10-23T14:13:11","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/36506\/Millions-At-Risk-From-Hardcoded-Creds-In-Popular-iOS-And-Android-Apps.html"},"modified":"2024-10-23T14:13:11","modified_gmt":"2024-10-23T14:13:11","slug":"millions-at-risk-from-hardcoded-creds-in-popular-ios-and-android-apps","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/millions-at-risk-from-hardcoded-creds-in-popular-ios-and-android-apps\/","title":{"rendered":"Millions At Risk From Hardcoded Creds In Popular iOS And Android Apps"},"content":{"rendered":"

An analysis of widely used mobile apps offered on Google Play and the Apple App Store has found hardcoded and unencrypted cloud service credentials, exposing millions of users to major security problems.<\/p>\n

The problem stems from lazy coding, according to<\/a> Yuanjing Guo and Tommy Dong, a pair of software engineers at Symantec’s Security Technology and Response. The duo warn that leaving creds in code means anyone with access to the app’s binary or source code could gain access to backend infrastructure and potentially exfiltrate user data.<\/p>\n

“This practice exposes critical infrastructure to potential attacks, endangering user data and backend services,” Symantec’s researchers warned. “The widespread nature of these vulnerabilities across both iOS and Android platforms underscores the urgent need for a shift towards more secure development practices,” they added.<\/p>\n

These are the apps in which Symantec spotted creds, but there may well be more:<\/p>\n