Research: Security Popular Travel Apps Seriously Flawed

The security of the most popular travel apps for both Android and iOS seriously flawed, according to research from Bluebox. Travel apps have changed a lot over the years and now offer a variety of options, such as booking flights and hotels. Now these apps get advanced options this provides new security risks and increases the attack surface.

For the study looked Bluebox the ten most popular travel apps for both Android and iOS. Only one of the ten Android apps pale 'data at rest' to encrypt the device, while none of the iOS apps did. It also showed that using two of the ten Android apps and one of the ten iOS apps Certificate Pinning. Certificate Pinning ensures that an app checks the certificate of the server so that it communicates with the appropriate server. This is to prevent man-in-the-middle attacks.

According to the researchers is to integrate a best practice to Certificate Pinning in the app, but it appears that the developers of travel apps to do this. Even in the three-apps that may apply the technique it appears that it is only used for a portion of the network connection, so that the rest of compounds is unprotected. The survey shows that most travel apps with code from other developers have been made and not 'in-house developed. This increases the attack surface.

The researchers conclude that the security of mobile apps is still in its infancy and travel apps, in particular, to tighten up security. Consumers who receive these apps are advised to only download apps from Google Play or the Apple App Store, use the latest version of operating system and application, be careful about using public Wi-Fi networks and untrusted certificate authorities switch.

Malware Infected Xiaomi Smartphone Appears Counterfeiting

Last week there was a fuss about Chinese smartphone manufacturer Xiaomi standard that malware would be delivered, but now it is confirmed that it is a counterfeit device. Bluebox security company published last Thursday a blog posting about malware that was found on the Xiaomi Mi 4 LTE smartphone. The company had bought the unit in China.

When scanning of the apps on the smartphone was found one suspect app, allowing users of information risk could walk.Initially the Chinese smartphone manufacturer would not have responded to the findings of Bluebox. After publication of the research did however a response, which the company claimed that there was possibly purchased a manipulated device.

Bluebox had purchased over the phone namely a physical supplier, while Xiaomi China does not sell equipment through "third-party" parties. The aircraft would only online and through the shops of telecom providers are offered. Then again Bluebox responded with criticism, because it was apparently possible for stores or anyone in the distribution chain to adjust the devices.

Counterfeit
After an extensive testing on the basis of all kinds of pictures is now been established that it is a counterfeit Mi 4. The unit was so well imitated that it initially also managed to circumvent a special app Xiaomi for detecting counterfeit devices. The latest version of the app can now detect the counterfeit version.

According Bluebox let the incident shows how important it is for companies to take researchers reports seriously and work together. Further notes the security of the supply chain, where it happens that consumers compromised smartphones can purchase. Finally, the tools to identify counterfeit goods must be improved.