02 April 2010

When a Bit of Security Forethought Would Go A Long Way

Thinking of creating a mobile phone application for your business? A major privacy failure with an iPhone application has been reported on the Zero Day blog and is a useful case study.

All iPhone apps have to be approved by Apple to "protect consumer privacy, safeguard children from inappropriate content, and avoid applications that degrade the core experience of the iPhone". But the application Quip from Addy Mobile Inc ~~provides~~ provided unlimited photo texting with the slogan "Why pay more for MMS? Don't you pay enough for your iPhone already?". Well, many of the application's users are paying for it now.

It seems the images (typically photos) were stored on a publicly-accessible web site, with the only access "control" being a random directory (folder) name five characters long—something that is easily iterated through to find photos and breach their customers' privacy. What makes it worse is that many of these messages and images were also turning up in public search engine results leaking sensitive information.

Partial screen capture from Google showing the search results for the query 'site:site:quiptxt.com' that include links and snippets from what were meant to be private messages

I was unable to find any privacy notice or privacy policy from the company:

Partial screen capture from Google showing no search results for the query 'site:site:quiptxt.com privacy'

The cached search results indicate the images are being stored using Amazon Web Services (AWS) S3. This is not a cloud computing specific issue. It could just as well be on a web site hosted by the company itself. The Quip web site (http://www.quiptxt.com), Quip message site (http://www.quiptxt.com) and Quip S3 image repository (http://quipimg.s3.amazonaws.com) are all currently offline. The comany issued a statement via Reddit. As the Zero Day blog says, these vulnerabilities would have been trivial to fix and protect the confidentiality of users' message text and photos. Using any of common sense, threat modelling, risk assessment or security verification should have identified the problems. I'm sure lawyers in the US will be circling. Since Apple approved the application, let's hope they are ready in case the lawyers knock on their door as well.

Addy Mobile Inc may itself be unavailable soon.

Posted on: 02 April 2010 at 11:04 hrs

Comments (1) | Permalink | Send | Post to Twitter

Comments

Comments are filtered automatically and should appear shortly after they been checked.

Great find. ...sadly there are a big bunch of these services, and I know of a few people who have downloaded the entire cache of pics/files uploaded from sites likes this for data mining purposes ...scary!

1 Added by Rafal Los Posted on 02 April 2010 at 22:11 hrs