Eavesdropper Bug Discovered In Almost 700 iOS And Android Apps: Careless Developers To Blame

Mobile security firm Appthority discovered a new vulnerability among iOS and Android apps that has compromised millions of text messages, phone calls, and voice recordings.

The vulnerability, which was given the name Eavesdropper, can be exploited by hackers, but the blame for the bug falls on careless developers.

What Does The Eavesdropper Bug Do?

In its report on the Eavesdropper vulnerability, Appthority noted that the bug gives hackers the ability to access text messages, phone calls, and voice recordings in nearly 700 iOS and Android apps.

About 33 percent of the apps are business-related, and more than 170 of them are currently available in Apple's App Store and the Google Play Store. The affected Android apps have been download up to 180 million times, while the figure is unknown for affected iOS apps.

Examples of apps that have the Eavesdropper bug include an app for secure communications within a federal law enforcement agency, an app that allows the sales team of a company to make audio recordings and make real-time annotations to discussions, as well as branded and white label navigations apps for customers that include AT&T and U.S. Cellular.

The Eavesdropper vulnerability is a major one due to it being easily exploitable for hackers. The information that the hackers can acquire from taking advantage of the bug also add to its seriousness, as they can acquire confidential knowledge about a company's confidential matters.

Careless Developers Blamed For Eavesdropper Bug

The Eavesdropper bug does not require a jailbreak or a root on a smartphone, does not exploit a vulnerability in an operating system, and does not launch its attack through the installation of malware.

Eavesdropper, instead, is caused by careless developers who failed to follow the security guidelines of cloud communications platform Twilio. The Twilio Rest API or SDK allows developers to easily add messaging and calling features into their apps. However, some developers that used the API left behind their user credentials in the code, which will allow hackers to access all the metadata stored in their Twilio accounts. This includes all the communications done through the compromised apps.

Appthority discovered Eavesdropper back in April and told Twilio about it in May. Twilio has since reached out to the developers behind the affected apps and are helping them apply the necessary security protocols.

The mobile security firm, however, cautioned that the problem might not be limited to only apps created with Twilio. It claims that the hard coding of credentials is a common developer error, so the other apps made by the careless developers may also have some security issues.

© 2018 Tech Times, All rights reserved. Do not reproduce without permission.

From Our Sponsor

Entropia Universe Allows Players To Earn Real Cash In The Virtual World

Everything in Entropia Universe has real cash value, and the real estate, land and deeds that players invest in are actual investments. The game uses a micropayment system that allows players to buy Project Entropia Dollars (PED), which is used as in-game currency. With a click of a mouse, PED can also be withdrawn from the game and transferred to your bank account using an e-money/e-wallet service like Neteller e-wallet.
Real Time Analytics