Study finds critical data security flaws in major travel apps
Saturday, 27 Sep, 2015
0
In many markets around the world, mobile use is gaining fast or even level with desktop as the primary platform for online travel bookings. Virtually every industry projection concurs that mobile use will undoubtedly forge ahead as the medium of choice in the trip planning and travel booking process. All the big players in the online travel space have mobile apps offering the ability to book flights, hotel rooms, car rental and more on the go, whenever and wherever you may be on your travels.
Customers download these apps in the knowledge that the same security features are present that are often taken for granted when making bookings on their websites. According to mobile security firm Bluebox Security, this blind acceptance could turn into a very expensive mistake. Bluebox analyzed the top ten most popular travel apps (each with millions of downloads) for both Android and iOS and found some glaring security vulnerabilities.
"We did a little bit of research in the app ecosystem where we wanted to see what kind of security protection is in place in apps, or rather what protections are not in place. We selected the category of travel apps, which are used by both consumers and enterprises every day for multiple things like airline booking, payments for hotels, restaurants and ride sharing," said Andrew Blaich, Bluebox’s head security analyst.
"We noticed that overall security is a second-class factor when apps are being developed," Blaich said. "We looked at a variety of different factors including third-party coders, data exposure and are they exposing or not protecting data they’re saving on the device like log in or credit card information."
The Bluebox study found that only one out 10 Android apps analyzed and none from the Apple App Store used any data encryption for stored information such as usernames, passwords, email addresses and even credit card numbers. The report described it as a ‘potentially catastrophic’ situation, but also identified other flaws.
About 70% of the code in the apps, Bluebox said, originated from external third-party sources and not created or indeed authenticated in-house. These range from social media APIs, location based content, and other travel related third party information. These come from numerous different Internet resources ‘significantly increasing the attack surface,’ it said. In addition, none of the apps had any anti-tamper or anti-debug protection, again leaving them exposed to possible attack.
"Some of the flaws we discovered would allow an attacker to create a malicious version of the app and have it look the same as the original app," Blaich added.
In conclusion, Bluebox stressed app security should be an essential part of the development process from the outset, with robust encryption, ‘self-defending’capabilities and the removal of any unnecessary third-party code.
TravelMole Editorial Team
Editor for TravelMole North America and Asia pacific regions. Ray is a highly experienced (15+ years) skilled journalist and editor predominantly in travel, hospitality and lifestyle working with a huge number of major market-leading brands. He has also cover in-depth news, interviews and features in general business, finance, tech and geopolitical issues for a select few major news outlets and publishers.
Vegas’s Billion-Dollar Secrets – What They Don’t Want Tourists to Know
Visit Florida’s New CEO Bryan Griffin Shares His Vision for State Tourism with Graham
Chicago’s Tourism Renaissance: Graham Interviews Kristin Reynolds of Choose Chicago
Graham Talks with Cassandra McCauley of MMGY NextFactor About the Latest Industry Research
Destination International’s Andreas Weissenborn: Research, Advocacy, and Destination Impact
Graham and Don Welsh Discuss the Success of Destinations International’s Annual Conference
Graham and CEO Andre Kiwitz on Ventura Travel’s UK Move and Recruitment for the Role
Brett Laiken and Graham Discuss Florida’s Tourism Momentum and Global Appeal
Graham and Elliot Ferguson on Positioning DC as a Cultural and Inclusive Global Destination
Graham Talks to Fraser Last About His England-to-Ireland Trek for Mental Health Awareness
Kathy Nelson Tells Graham About the Honour of Hosting the World Cup and Kansas City’s Future
Graham McKenzie on Sir Richie Richardson’s Dual Passion for Golf and His Homeland, Antigua
ADS PRO 
Clearing CSS/JS assets' cache... Please wait until this notice disappears...
Updating... Please wait...
Airlines suspend Madagascar services following unrest and army revolt
TAP Air Portugal to operate 29 flights due to strike on December 11
Qatar Airways offers flexible payment options for European travellers
Air Mauritius reduces frequencies to Europe and Asia for the holiday season
Airbnb eyes a loyalty program but details remain under wraps