AppBugs: Fourteen apps, which to date have around 80 million downloads, have serious shortcomings in the way they handle social connections.
AppBugs, a security vulnerability tracking tool, has discovered issues in a large number of Android apps that use social connections from Google, Microsoft, Facebook, Twitter and other services, according to VB.
For example:
Astro File Manager exposes Microsoft account passwords. Astro File Manager has had around 100 million downloads to date, according to AppBugs. MeituPic exposes Facebook, Baidu, and Renren.com accounts. MeituPic has had between 10 million and 50 million downloads, according to AppBugs. gReader , a popular news app , according to AppBug, “exposes all of a user’s social accounts, including Facebook, Google, Twitter, Microsoft, and Evernote.”
(The full list of AppBugs apps is at the end of the post.)
These problems are due to weaknesses in the way applications handle SSL certificates, which servers use to verify an identity.
These flaws allow an attacker to use fake SSL certificates to obtain users' login credentials.
AppBugs reports that it has contacted each of the developers of these apps and that it has not received a response in four months.
"To date, only one developer (of the Foxit MobilePDF app) has fixed the issue," said Rui Wang of AppBugs.
Below is the list of problematic apps found by AppBugs.
- MeituPic
- Astro File Manager with Cloud
- gReader
- Windows Live Hotmail Push Mail
- JustUnFollow
- Brother iPrint & Scan
- Software Data Cable
- FriendCaster Chat
- PrintHand Mobile Print
- Phone for Google Voice & GTalk
- Instachat
- InstaMessage
- InstaG
- FoxIt MobilePDF
