Apps and Widgets for any use, mostly for education and FREE

Untersucht wurden 2107 Apps für iOS von 601 Herstellern. Die HP-Tochter bewertet die entsprechenden Android-Anwendungen jedoch als ebenso anfällig. Zahlreiche Apps setzten keine Verschlüsselung ein und schützten die Nutzerdaten nicht angemessen.

Security-SuperGAU für alle Nutzer von iPhones und iPads: Experten haben eine Lücke in iOS-Apps entdeckt, die es erlaubt, die komplette Kommunikation über fremde Server umzuleiten. Tausende Apps sollen betroffen sein.

 

Über HTTP Request Hijacking sollen sich Hacker in iOS-Apps einschleichen und so den Datentraffic über eigene Server umleiten können. Nach erfolgreichem Angriff soll die Umleitung dann permanent aktiv sein.

 

===> Einzige Abhilfe schafft ein Update oder eine Neuinstallation der App. <===

 

 

Via Gust MEES

Summer 2013 App Reputation Report to examine the hidden behaviors behind free and paid mobile apps

 

The cloud-based, fully automated Appthority App Risk Management Service performed static, dynamic and behavioral app analysis on the 400 most popular free and paid apps on the iOS and Android platforms.

 

  

Appthority analyzed each app for particular behaviors within a test environment

.

Highlights from the App Reputation Report are:

 

- Overall, 83% of the most popular apps are associated with security risks and privacy issues.

 

- iOS apps exhibited more risky behaviors than Android apps. 91% of iOS apps exhibit at least one risky behavior, as compared to 80% of Android apps.

 

- 95% of the top free apps and 77.5% of the top paid apps exhibited at least one risky behavior.

 

- 78% of the most popular free Android apps identify the user's ID (UDID).

 

- Even though Apple prohibits its developers from accessing the UDID, 5.5% of the tested iOS apps still do.

 

- 72% of the top free apps track for the user's location, compared to 41% of paid apps.

 

- Although paid apps already generate revenue when downloaded, 59% of paid iOS and 24% of paid Android apps still support in-app purchasing.

 

- Furthermore, 39% of paid iOS and 16% of paid Android apps still share data with ad networks.

 

12 December 2013

Word that mobile malware is rather pervasive has been making the rounds for months, but a new report has found that a shocking 100% of the Top 100 paid Android apps and 56% of the Top 100 paid Apple iOS apps have been hacked. Averaged together, users have a 78% chance of running into an app that has been compromised at some point.

An app called InstLike promised free likes and followers on Instagram, but asked users to provide their usernames and passwords, turning them into a botnet.

 

Moreover, a user would get 20 free Likes if he used the hashtag #instlike_com in his own photo captions. A search on Instagram reveals that more than 500,000 photos already contain that hashtag.

 

All these features made InstLike a sophisticated ecosystem that employed thousands of voluntary "zombie" accounts — but it depended on their naiveté and willingness to give up their passwords.

 

For Narang, who is experienced in the realm of social media-based scams, the sheer volume of people involved is scary.

 

 

With the threat already in ads, are mobile users left vulnerable to attacks?

 

Though developers need to be very careful installing ad networks in their apps, users can still protect themselves by

 

===> making sure that the Android system setting ‘Unknown sources’ is unchecked to prevent dropped or drive-by-download app installs and installing security apps like Lookout to as their first line of defense against malware. <===

 

Security researchers have discovered a vulnerability that could allow attackers to take full control of most Android smartphones

 

The vulnerability allows hackers to modify an app without breaking its cryptographic signature, according to Jeff Forristal, chief technology officer (CTO) at mobile security firm Bluebox.