China's top Android phones exfil significant data without consent - Mobile Privacy Briefing 2023.104

If you’re in the market for a new Android device and value your privacy, avoid purchasing it in China! While this is not likely for most folks following my content, it was eye opening to see just how much data is exfiltrated from mainland China devices. I first came across this research in an article by The Register titled “Surprise! China’s top Android phones collect way more info”. The researchers on the paper include Haoyu Liu (The University of Edinburgh), Douglas J.

Fraudulent trading apps in Apple and Google app stores - Mobile Security Briefing 2023.102

Sophos released some great analysis last month on fraudulent trading apps in Apple and Google app stores. What really caught my interest was how the apps passed the app approval processes at both Apple and Google. As a mobile security researcher, I’ve long known that the review processes on both the App Store and Play Store are no substitute for bespoke mobile app security and privacy testing (full disclosure: I’m the co-founder of NowSecure).

BetterHelp shares mental health data without consent - Mobile Privacy Briefing 2023.101

“BetterHelp will be required to pay $7.8 million for deceiving consumers after promising to keep sensitive personal data private” reads the subtitle to the FTC press release on 2 Mar 2023. While BetterHelp roll out the tired response that the settlement “is no admission of wrongdoing”, it can still be true if you don’t admit it. What exactly did they do? From the FTC complaint: BetterHelp used and revealed consumers’ email addresses, IP addresses, and health questionnaire information to Facebook, Snapchat, Criteo, and Pinterest for advertising purposes, according to the FTC’s complaint

Unofficial ChatGPT mobile apps pose privacy risk - Mobile Privacy Briefing 2023.095

Top10VPN researchers uncovered privacy violations in the top 10 unofficial ChatGPT apps on the Apple App and Android Play Stores. I say unofficial because OpenAI does not offer official ChatGPT mobile apps (you should use ChatGPT via the web interface). It’s not surprising that a technology that exploded into the mainstream so quickly would also create an opportunity for privacy (and probably security) abuse. Many folks are probably not aware that these apps are unofficial and certainly don’t inspect what sort of data is collected.

SBOM analysis of 10 popular Android sports and betting apps by Synopsys CyRC - Mobile Security Briefing 2023.094

The Cybersecurity Research Center at Synopsys analyzed the Software Bill of Material (SBOM) for 10 populars Android sports and betting apps and released their findings earlier this month. Not surprisingly, many of the apps contained outdated and vulnerable open source components. You should take a look at the report as it’s interesting and well written. But I’d like to focus in on two important points that they made. Exploitable Whenever a developer is presented with evidence of a vulnerable dependency, I suspect on of the first questions that comes to mind is: ok, but is that code used and exploitable?

Vulnerabilities in Hyundai and Genesis mobile apps allow full remote vehicle access and full account takeover - Mobile Security Briefing 2023.093

Sam Curry (Twitter | Homepage), a Web Application Security Researcher, and a small group of friends found a staggering number of serious vulnerabilities in the mobile and web apps of nearly 20 automotive companies. He provides a fairly detailed write up on his blog “Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More” and here’s a Twitter thread about Hyundai and Genesis mobile app with starting with:

DoD IG report on mobile apps uncovers serious operational and cybersecurity risks - Mobile Security Briefing 2023.092

The Department of Defense’s Inspector General released a management advisory on 9 Feb 2023 titled “The DoD’s Use of Mobile Applications” (version with highlights). The advisory determined that: “DoD personnel are conducting official business on their DoD mobile devices using mobile applications in violation of Federal and DoD electronic messaging and records retention policies” “DoD personnel are downloading mobile applications to their DoD mobile devices that could pose operational and cybersecurity risks to DoD information and information systems.

NSA Mobile Device Best Practices - Mobile Security Briefing 2023.091

The National Security Agency (NSA) maintains a list of NSA Cybersecurity Advisories & Guidance and recently released a list of Best Practices For Securing Your Home Network. These are certainly worth taking a look at and for folks worried about downloading a PDF from the NSA, I’ve listed the primary recommendations at the bottom of this blog. While reviewing the document, though, I noticed a link to their Mobile Device Best Practices and wanted to pass that along as well.

TikTok privacy insights via reverse engineering - Mobile Privacy Briefing 2023.084

On the more technical side, my friend Sebas creates a curated weekly summary of security (and other) topics in the Security Pills Newsletter. In Issue 27, he linked to an interesting technical write up of the great lengths TikTok has gone to obfuscate how their code works and in particular related to the sensitive personal data collected (shout our to vetias at for the excellent re work and write up).

Scandinavian Airlines mobile app cyberattack - Mobile Security Briefing 2023.083

On 14 Feb 2023, Scandinavian Airlines warned users to stop using their mobile app as they were under an active cyberattack and user’s may receive incorrect data, including other customer’s personal information including: contact details previous and upcoming flights last four digits of the credit card number The incident was resolved several hours later but additional details are not available at this time. The last updated was posted in the Newsroom section of the SAS website on February 15, 2023 12:56.