Security Android apps and dodgy password practices

eva2000 · Apr 16, 2018

Ouch Android apps prove a goldmine for dodgy password practices

Will Dormann, software vulnerability analyst at the CERT Coordination Center (CERT/CC), told the BSides conference in San Francisco that he’d scanned around 1.8 million Android apps and found shocking lapses in operational security in plenty of 'em. PGP keys, VPN codes and hardcoded admin passwords were all readily available.

“I only scanned free apps,” he explained. “Paid apps have similar issues I’m sure but the problem is I’ve downloaded 1.8 million apps and even if they are only 99 cents apiece I’m not paying that much.”

Overall he found nearly 20,000 apps with insecure keys built in, including popular code like Samsung’s "smart" home app. Building passwords into apps is lazy developer policy for some, although he noted some are better than others at obfuscating the practice.

On one end of the scale was an app developer who not only hardcoded his Android and iOS developer login details in the app but also the master passwords for the app itself. Others were sneakier, trying to hide the important data in .png or .apk files.
Click to expand...

The key to strong passwords is length and complexity. Go long on passwords, avoid words easily spotted in dictionary attacks and never, ever, use "QWERTY".
Click to expand...

Log in / Register

Forums

Welcome to Centmin Mod Community

Security Android apps and dodgy password practices

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

Security Android apps and dodgy password practices

eva2000 Administrator Staff Member

.