Developers of many enterprise apps potentially expose sensitive data by failing to properly secure the connection between back-end servers and the app, according to research.
Security firm Appthority used specialist research techniques to analyze the impact of a newly discovered data exposure vulnerability dubbed “HospitalGown.” The vulnerability, which affects hundreds of enterprise apps, is caused when app developers do not secure back-end servers with firewalls and authentication.
Mitigating the vulnerability could be difficult, as the breaches are related to the back-end platforms of vendors. News of the risk should be a timely reminder to IT decision-makers to pay attention to how their data is stored and secured, and how its use is governed.
What Is the Vulnerability?
Appthority’s Mobile Threat Team discovered HospitalGown using back-end scanning as part of its mobile app analysis techniques. The team used the approach to analyze the network traffic of more than 1 million enterprise iOS and Android apps.
Enterprise apps often connect to back-end databases that store user information. Appthority decided to focus its investigation on apps that use Elasticsearch, which is one of the most popular tools used to analyze and mine data stored on back-end servers.
Appthority found 1,000 affected apps on enterprise mobile devices connected to more than 21,000 open Elasticsearch servers, revealing almost 43 TB of exposed data. Detailed research of 39 applications with big data leaks revealed that 163.53 GB of data, or approximately 280 million records, had already been exposed.
Enterprise Apps Left Exposed
SecurityWeek reports that while the connection between the mobile app, its application programming interface and the Elasticsearch data store is typically secure, the Elasticsearch server is often exposed to the internet. The records were accessible because of weakly secured back ends and did not require authentication to access the data.
Leaked data included personally identifiable information such as passwords, location, travel and payment details. The information also included corporate profile data such as emails and phone numbers, as well as retail customer data.
Appthority believes the exposed data could be used to launch further attacks or to conduct fraud. The data could also be sold to other actors for malicious activities. The security firm has reached out to the mobile application developers, app stores and hosting providers associated with the data leaks.
How Can IT Decision-Makers Respond?
Appthority says it named the threat HospitalGown because of the back-end data exposure risk associated with the vulnerability. It says the vulnerability opens organizations to an easy breach, loss of sensitive data, costs associated with remediation, lawsuits and loss of brand trust.
Worse still, according to Dark Reading, mitigation could be difficult. While standard best practice for enterprise mobile security often involves locking down devices, the HospitalGown vulnerability involves unsecured back-end servers, which are a separate route to information. The exposure is difficult for IT teams to detect because the breach occurs on the vendors’ back-end platforms.
The report suggests the vulnerability will only be eliminated by back-end platform configuration improvements and possibly code changes within the affected app. If the vulnerability is related exclusively to back-end systems, then even updating the app will not solve the problem.
Naked Security suggests the vulnerability offers a compelling case for organizations to take a much tighter grip on how mobile data is stored once it leaves users’ devices and enters the cloud. The research is also a timely reminder of the need for IT decision-makers to prepare for the strict compliance associated with the forthcoming EU General Data Protection Regulation (GDPR).