Another Massive Data Leakage Incident Reported

We shouldn't be surprised by this anymore, and regular readers know I've talked about the risks of data leakage on multiple occasions. This has the same characteristics as HospitalGown and Eavesdropper: the app itself is not necessarily insecure; instead, the cloud-based storage system hasn't been properly secured.

The app in this case is A.I.type Keyboard, available on both Google Play and the App Store. This threat was discovered by The Kromtech Security Center. What they learned was that the A.I.type Keyboard app leaked PII and other data from over 31 million users. The root cause appears to be that the app's backend, a 577 GB MongoDB database, was misconfigured so that all of it's data is available to anyone with an Internet connection.

What is included in the exposed 577 GB? Here's a partial rundown:

Phone number, full name of the owner, device name and model, mobile network name, SMS number, screen resolution, user languages enabled, Android version, IMSI number (international mobile subscriber identity used for interconnection), IMEI number (a unique number given to every single mobile phone), emails associated with the phone, country of residence, links and the information associated with the social media profiles (birthdate, title, emails etc.) and photo (links to Google+, Facebook etc.), IP (if available), location details (long/lat).

In addition, there were over 6 million records that contained "data collected from users’ contact books, including names (as entered originally) and phone numbers, in total more than 373 million records scraped from registered users’ phones, which include all their contacts saved/synced on linked Google account."

Ouch. One of the things that's a bit unusual--and pretty insidious-- is the information associated with social media profiles. This should enable a second level of privacy invasion and surveillance against the victims. Given how valuable data is to marketers as well as black hats, this data will no doubt find its way into various commercial and dark net datasets, so be used at some future date with almost zero chance of tracing it back to the offending app.

Well, at least it's not mobile malware, right? So we shouldn't worry, correct? We'll see what kind of media coverage this gets.

Eavesdropper: Can You Hear Me Now?

Appthority released research today on a newly discovered vulnerability dubbed Eavesdropper. This is yet another case where enterprise data is leaked from mobile devices, in this scenario by legitimate app developers failing to secure cloud storage (specifically, by including hard coded credentials in mobile applications that are using the Twilio REST API or SDK).

Quoting from Appthority's blog,

Eavesdropper does not rely on a jailbreak or root of the device, take advantage of a known OS vulnerability, or attack via malware. 

In other words, Eavesdropper does not result from malicious code on the mobile device. The vulnerability is app developer error, pure and simple, and the exposure is not on the device but in the cloud. But this error, multiplied by hundreds of apps and millions of downloads, causes text/SMS messages, call metadata, and voice recordings to be exposed to any and all comers. Once the data is exposed, malicious actors can easily find it and launch an attack based on that data. The "attack" may be cyber or it may be in the real world, based on proprietary knowledge acquired from the exposed enterprise data.

Headlines about the latest malware threat get our attention, but there are no known malware attacks that have exposed nearly the amount of data--measured in terabytes--as Eavesdropper and HospitalGown. As we've noted previously, data leakage from mobile devices is a real, demonstrable threat but enterprises often focus on malware and legacy endpoint paradigms. A broader perspective than simply a focus on the device is required to detect and remediation such threats and protect enterprise data.

Mobile Data Leakage Versus DLP

Seth Hardy over at Appthority has an interesting post this week, discussing how a focus on malware protection can cause enterprises to miss the threat of data leakage from legitimate public store apps. And a new case study from Lookout, describing how their solution addressed customer objectives that include reducing customer data leakage risks, also addresses this emerging threat vector.

I see this as a positive trend, as more vendors and enterprises focus on what's important: protecting corporate data.

In talking about mobile data leakage, I find that people often confuse that with data loss protection (DLP). The issues are similar, in that they focus on data loss, but they address completely different problems. It's worth a brief outline of each threat scenario to clarify:

When enterprises talk about defense in depth, DLP often represents the last line of defense. If an attack breaches NGFW, IDS/IDP and CASB protections and eludes breach detection systems, it will ultimately attempt to exfiltrate data. DLP solutions are designed to detect and possibly block the exfiltration, and among other features it may recognize bulk transfer of SSNs or credit card numbers that have been aggregated in an internal data set. The large data set was the ultimate target of the attackers, who had to circumvent a number of enterprise defenses to access it.

Mobile data leakage is different. In this case aggregation takes place outside of the enterprise infrastructure in a backend server or a cloud storage system. The data set in this case may contain personally identifiable information (PII) for thousands of employees, or it may contain sensitive corporate information. This could be the backend for an app that was deployed enterprise wide, such as CRM, ERP, endpoint security, or an internal productivity app. If a malicious actor intends to access such sensitive information, it's far more feasible that a cloud server could be breached than that thousands of mobile devices could be successfully attacked with malware. And in this example, the enterprise-wide app has already done the heavy lifting of collecting such information into a single file system or database. There's ample evidence that mobile app developers can be lax when it comes to cloud-based storage security, so the threat is amplified due to the ease with which the database can be breached. That's why mobile data leakage is a rising concern.

The biggest challenge for enterprises is that use of mobile devices creates new threats to corporate data. Attackers usually choose the path of least resistance, and exposed data in the wild represents an easy exploit.