June 5, 2017 By Mark Samuels 2 min read

Developers of many enterprise apps potentially expose sensitive data by failing to properly secure the connection between back-end servers and the app, according to research.

Security firm Appthority used specialist research techniques to analyze the impact of a newly discovered data exposure vulnerability dubbed “HospitalGown.” The vulnerability, which affects hundreds of enterprise apps, is caused when app developers do not secure back-end servers with firewalls and authentication.

Mitigating the vulnerability could be difficult, as the breaches are related to the back-end platforms of vendors. News of the risk should be a timely reminder to IT decision-makers to pay attention to how their data is stored and secured, and how its use is governed.

What Is the Vulnerability?

Appthority’s Mobile Threat Team discovered HospitalGown using back-end scanning as part of its mobile app analysis techniques. The team used the approach to analyze the network traffic of more than 1 million enterprise iOS and Android apps.

Enterprise apps often connect to back-end databases that store user information. Appthority decided to focus its investigation on apps that use Elasticsearch, which is one of the most popular tools used to analyze and mine data stored on back-end servers.

Appthority found 1,000 affected apps on enterprise mobile devices connected to more than 21,000 open Elasticsearch servers, revealing almost 43 TB of exposed data. Detailed research of 39 applications with big data leaks revealed that 163.53 GB of data, or approximately 280 million records, had already been exposed.

Enterprise Apps Left Exposed

SecurityWeek reports that while the connection between the mobile app, its application programming interface and the Elasticsearch data store is typically secure, the Elasticsearch server is often exposed to the internet. The records were accessible because of weakly secured back ends and did not require authentication to access the data.

Leaked data included personally identifiable information such as passwords, location, travel and payment details. The information also included corporate profile data such as emails and phone numbers, as well as retail customer data.

Appthority believes the exposed data could be used to launch further attacks or to conduct fraud. The data could also be sold to other actors for malicious activities. The security firm has reached out to the mobile application developers, app stores and hosting providers associated with the data leaks.

How Can IT Decision-Makers Respond?

Appthority says it named the threat HospitalGown because of the back-end data exposure risk associated with the vulnerability. It says the vulnerability opens organizations to an easy breach, loss of sensitive data, costs associated with remediation, lawsuits and loss of brand trust.

Worse still, according to Dark Reading, mitigation could be difficult. While standard best practice for enterprise mobile security often involves locking down devices, the HospitalGown vulnerability involves unsecured back-end servers, which are a separate route to information. The exposure is difficult for IT teams to detect because the breach occurs on the vendors’ back-end platforms.

The report suggests the vulnerability will only be eliminated by back-end platform configuration improvements and possibly code changes within the affected app. If the vulnerability is related exclusively to back-end systems, then even updating the app will not solve the problem.

Naked Security suggests the vulnerability offers a compelling case for organizations to take a much tighter grip on how mobile data is stored once it leaves users’ devices and enters the cloud. The research is also a timely reminder of the need for IT decision-makers to prepare for the strict compliance associated with the forthcoming EU General Data Protection Regulation (GDPR).

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today