November 18, 2015 By Shane Schick 2 min read

App developers love using backend-as-a-service (BaaS) companies to store and host the data they collect from users, but researchers recently warned the way they do so could be putting sensitive data in front of the prying eyes of cybercriminals.

(In)Security of Backend-as-a-Service,” a paper presented at the recent Black Hat Europe conference, showed how hard-coded credentials in many iOS and Android apps could be easily removed to provide access to sensitive data. As part of their study, the researchers published a tool called HAVOC to help spot apps where BaaS connections might introduce security risks. Close to 19 million records and 56 million pieces of data were discovered in a review of 2 million apps.

To some extent, the very ease of using BaaS services is the same reason they pose security threats. As Computerworld noted, app developers can quickly sign up and download a software development kit (SDK) to start using third-party providers to store information in the cloud and manage things like push notifications. The research revealed that there is a systemic mistake being made: using primary BaaS credentials as access keys. This puts cybercriminals much closer to sensitive data than they would hope to get otherwise.

For example, SecurityWeek reported that researchers were quickly able to see personally identifiable information such as dates of birth, phone numbers, email addresses and locations. Even worse, it’s possible for third parties to modify sensitive data they obtain through BaaS services depending on the kind of mobile app in use. This could open up even more security problems if attackers start to exploit these holes and tamper with financial transaction records, social media profile details and so on.

Of course, a lot of consumer mobile apps are made by independent developers. As more large companies and brands create apps for personal or even business use, they may approach BaaS offerings a little differently and use more security-focused default credentials that would protect sensitive data. In the meantime, The Register suggested that ongoing education for the developer community should become a priority for companies like Amazon and Facebook, as should vulnerability scanning before apps are submitted to app stores.

More from

New memo reveals Biden’s cybersecurity priorities through fiscal year 2026

2 min read - On July 10, 2024, the White House released a new memo regarding the Biden administration’s cybersecurity investment priorities, initially proposed in July 2022. This new memorandum now marks the third time the Office of the National Cyber Director (ONCD), headed by Harry Coker, has released updated priorities and outlined procedures regarding the five core pillars of the National Cybersecurity Strategy Implementation Plan (NCSIP), now relevant through fiscal year 2026. Key highlights from the FY26 memorandum In the latest annual version…

How prepared are you for your first Gen AI disruption?

5 min read - Generative artificial intelligence (Gen AI) and its use by businesses to enhance operations and profits are the focus of innovation in virtually every sector and industry. Gartner predicts that global spending on AI software will surge from $124 billion in 2022 to $297 billion by 2027. Businesses are upskilling their teams and hiring costly experts to implement new use cases, new ways to leverage data and new ways to use open-source tooling and resources. What they have failed to look…

Cybersecurity crisis communication: What to do

4 min read - Cybersecurity experts tell organizations that the question is not if they will become the target of a cyberattack but when. Often, the focus of response preparedness is on the technical aspects — how to stop the breach from continuing, recovering data and getting the business back online. While these tasks are critical, many organizations overlook a key part of response preparedness: crisis communication. Because a brand’s reputation often takes a significant hit, a cyberattack can significantly affect the company’s future…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today