{"id":46760,"date":"2015-12-22T06:00:23","date_gmt":"2015-12-22T14:00:23","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=46760"},"modified":"2025-08-15T07:49:48","modified_gmt":"2025-08-15T14:49:48","slug":"exposed-mobile-data","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/privacy-identity-protection\/exposed-mobile-data\/","title":{"rendered":"Behind the\u00a0Mobile App: Your Data Exposed"},"content":{"rendered":"

Taylor Swift dropped a musical explosion when she released her music video for the song \u201cBad Blood\u201d<\/a> earlier this year. The song and its accompanying video captivated audiences as it depicted something many could relate to \u2013 being betrayed by a trusted peer. Who would have thought the basis of a song could also be applied to our mobile phones? More specifically, mobile apps.<\/p>\n

Whether it\u2019s Facebook, Amazon, or Candy Crush, mobile users are crazy about their apps. But, do they love us back? In a recent study<\/a> performed by researchers from the Technical University and the Fraunhofer Institute for Secure Information Technology in Darmstadt, Germany it was found that thousands of mobile apps implement cloud-based, back-end services in a way that lets anyone access users\u2019 sensitive records. Thus, mobile apps are not as secure as we\u2019d like to think they are. That\u2019s one way to create \u201cBad Blood\u201d between users and their apps.<\/p>\n

What are back-end services, you ask? Backend-as-a-service (BaaS) offer cloud-based database storage. These services provide the apps with push notifications, user administration, and more. Mobile apps use this service to make their apps seamless to use, while also minimizing the knowledge developers need to maintain the back-end servers of an app.<\/p>\n

When developers use BaaS, they integrate the BaaS software into their apps and use the back-end service through simple application programming interfaces, better known as APIs. What researchers found, however, was that developers use APIs in the primary BaaS access key in the apps, which is bad news for app users because this practice allows data to be exposed. Mobile apps are easily reverse-engineered to extract the credentials needed to access back-end databases, where users\u2019 data is hosted.<\/p>\n

The researchers took their study one step further to see just how bad this problem was. They tested more than 2 million Android and iOS apps and were able to extract 1,000 back-end credentials. Many of the credentials were reused in multiple apps created by the same developers. From the back-end credentials, more than 18.5 million records were exposed.<\/p>\n

Although the researchers didn\u2019t download the records, they still could see what types of data were being exposed. This included user-specific location data, birthdays, contact information, telephone numbers, pictures, valid email addresses, purchase data, and private messages. Data you wouldn\u2019t want criminals to have access to, right?<\/p>\n

Things to Help Protect Your Data<\/h2>\n

While the problem is mostly out of your hands and in the hands of the developers, there are still things you can do to help protect your data!<\/p>\n