Typing Predictions of SwiftKey May Have Leaked Users' Emails

SwiftKey, the popular keyboard app that was bought by Microsoft earlier in the year, posted an entry on its blog that outlined immediate changes to its cloud sync service.

Unexpected Predictions

“This week, a few of our customers noticed unexpected predictions where unfamiliar terms and, in some rare cases, emails, appeared when using their mobile phone,” the post read. “We are working quickly to resolve this inconvenience.”

SwiftKey asserted that the irregularities did not pose a security threat to its customers. As a precaution, however, the app has disabled its cloud sync service and email address predictions.

The company admitted that the app’s email address predictor could generate another customer’s email address, and other “unfamiliar predictions” could show up as well. Even if it modifies the methods for harvesting typed emails, SwiftKey still has these unfamiliar phrases coming from somewhere.

It’s good that it is “working quickly” to resolve this major inconvenience, which stops the keyboard from performing the basic function that someone would want it to do in the first place. Without it, why even have the app on your phone?

Strange Suggestions

“A few users on Reddit have noticed that it’s been offering strange suggestions — including emails they’ve never seen and foreign language terms they’ve never used,” CSO Online reported.

The source also noted that one user got a brand new language in the deal. “And now, I’m getting someone else’s German predictions,” CSO Online quoted one user, who recently rooted a Samsung Galaxy S6 phone, as writing. “I have never typed German in my entire life.”

SwiftKey and Passwords

SwiftKey has said that it doesn’t collect any password or credit card data that may be typed by users. While that seems reassuring, consider that the tool has to recognize that the user-typed string is indeed a password. Otherwise, how can it assert that it is not storing it with other user-generated string data?

Microsoft hasn’t said when the cloud syncing feature could return, but one can only hope it will be working properly when it does come back.

Larry Loeb

Principal, PBC Enterprises

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Unexpected Predictions

Strange Suggestions

SwiftKey and Passwords

More from

What we can learn from the best collegiate cyber defenders

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

New proposed federal data privacy law suggests big changes

Topic updates