[4509] in Privacy_Forum
[ PRIVACY Forum ] Personal banking apps leak info through phone
daemon@ATHENA.MIT.EDU (PRIVACY Forum mailing list)
Fri Jan 10 21:55:37 2014
Date: Fri, 10 Jan 2014 18:20:40 -0800
To: privacy-list@vortex.com
Message-ID: <20140111022040.GB30270@vortex.com>
MIME-Version: 1.0
Content-Disposition: inline
From: PRIVACY Forum mailing list <privacy@vortex.com>
Reply-To: PRIVACY Forum mailing list <privacy@vortex.com>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: privacy-bounces+privacy-forum=mit.edu@vortex.com
Content-Transfer-Encoding: 8bit
Personal banking apps leak info through phone
http://j.mp/1aoJnV2 (IO Active)
"Many of the apps (90%) contained several non-SSL links throughout the
application. This allows an attacker to intercept the traffic and
inject arbitrary JavaScript/HTML code in an attempt to create a fake
login prompt or similar scam. Moreover, it was found that 50% of the
apps are vulnerable to JavaScript injections via insecure UIWebView
implementations. In some cases, the native iOS functionality was
exposed, allowing actions such as sending SMS or emails from the
victim's device."
- - -
--Lauren--
Lauren Weinstein (lauren@vortex.com): http://www.vortex.com/lauren
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
privacy mailing list
http://lists.vortex.com/mailman/listinfo/privacy
