92% of Financial Apps in Google Play App Store Contain Leaky Data

A recent study by Approov, a mobile security company, has revealed that nearly 92% of financial apps hosted on the Google Play App Store contain extractable data such as application programming interface (API) keys. The study, which focused on the top 200 financial services apps in the United States, United Kingdom, France, and Germany, found that a quarter of these leaky apps spilled extremely sensitive data, including authentication keys used for payments and monetary account transfers.

The researchers at Approov's Mobile Threat Lab used open-source tools such as apk_ api_key_extractor, gitLeaks, and Trufflehog to find sensitive data in the mobile app packages. They also ran Python scripts to analyze, classify, and present the data obtained through static analysis of apps and dynamic analysis of code execution on mobile devices.

According to Ted Miracco, chief executive officer of Approov, hackers can easily obtain this information using the same open-source tools used by the researchers. He pointed out that even if keys and secrets cannot be easily reverse-engineered from the mobile app code, hackers can still grab sensitive data at runtime by manipulating the app, environment, or communication channels.

The study's findings are a wake-up call for financial institutions and app developers to prioritize security measures in their mobile apps. With nearly 92% of financial apps containing extractable data, it's crucial that these companies take steps to protect their users' sensitive information.

In conclusion, the study highlights the importance of static analysis and dynamic testing in identifying and addressing vulnerabilities in mobile apps. By using open-source tools and running Python scripts, developers can proactively identify potential security risks and ensure the integrity of their app code.

Google app store