Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

4/6/2016
09:25 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

How Some Apple, Android Mobile Tax Apps Put Sensitive Data At Risk

A review of 29 Apple iOS and Android apps used for tax filing purposes show many are not fully secure, Appthority says.

E-filing tax returns via a smartphone can be convenient and fast, but many of the income tax-filing apps people use are not so secure.

With this year’s tax deadline looming, security vendor Appthority decided to do a quick analysis of several mobile tax applications. In all, the company reviewed 29 Android and Apple iOS tax applications for risky behaviors such as collecting and transmitting personally identifiable information, sharing location data with third parties, and transmitting sensitive tax data without encryption.

The results were a mixed a bag. On the one hand, many of the applications that Appthority reviewed have vulnerabilities that put highly sensitive user data like Social Security Numbers and earnings information, at risk. But none of them are severe enough to warn users off them altogether.

According to Appthority, the goal of the review is to alert mobile users about the potentially risky behavior of tax apps -- some of which have been developed by companies with considerable resources and development experience. “We suspect even more vulnerabilities can be found in lesser known apps which are not developed with enterprise grade resources,” the company said.

Here are some of the potential risks, organized by severity level, that Appthority identified in the mobile tax-filing apps:

1. Low-risk vulnerabilities

A total of eight mobile tax applications exhibit what Appthority describes as low-risk vulnerabilities stemming from a failure to adhere to security best practices. The most common among them are so-called full path disclosure flaws that basically enable an attacker to see the entire path to the app’s source code.

Such vulnerabilities allow a way into server-side code from the client, and can give adversaries critical information on how to attack an application. This type of vulnerability can occur when either the developer of the app or development kit used to write the app fails to delete its source code, Appthority says.

Such vulnerabilities do not pose a direct threat to users of these apps, but they can be problematic in an enterprise or government context.

Apps with this kind of vulnerability include the iOS versions of TurboTax, one of the most popular tax-filing apps; Evernote; Expensify; and IRS2Go. With many of the applications, the vulnerability exists in the source code of SDKs they use. But some apps -- Evernote, IRS2Go, and MyTaxRefund -- are vulnerable due to issues in their own source code.

2.Medium-risk flaws

A total of three apps—two of them iOS and one Android—display a combination of behaviors that Appthority determines are serious enough to put them in the medium-risk category. These behaviors include accessing privacy-invasive information on the mobile device, and not adequately encrypting sensitive data. The flaws could potentially put user data at risk in certain situations. For instance, people doing their taxes in a public Wi-Fi setting like a coffee shop could have their data intercepted and stolen as a result of weak encryption.

“If an app is transmitting information without encryption, then anyone in the same network can read and intercept that data,” says Domingo Guerra, co-founder of Appthority. “When the attacker sees a [unique device ID] go through, they could take advantage of a well-known vulnerability in TrueCaller to intercept [the ID]” and grab personal data belonging to the user, he says. “Because not all apps handle encryption correctly, users should avoid using apps that touch or transmit sensitive data when on a public or insecure Wi-Fi connection.”

Two of the applications—MyBlock and IRS2Go—landed in this category for sharing the user’s location data in the clear without any encryption. The other app with a medium-risk flaw is CPA Tax Answers Free, which Appthority faults for sending certain tax-related data unencrypted.

3. High-risk flaws.

Appthority’s highest risk category was reserved for mobile tax applications that store or transmit sensitive and personally identifiable data, including unique device identifier information, without encryption. Just three apps out of the 29 apps in the study fall into this category: the Android version of MyBlock, which transmits device ID and PII unencrypted; the Android version of Calculator for US Taxes, which sends unencrypted PII; and the iOS version of TaxBot, which transmits device ID information insecurely.

The likelihood of the flaws being exploited is relatively low, accordind to Appthority, but the company recommends avoiding public Wi-Fi and using a secure, password-protected network when filing taxes via mobile apps.

Related content:

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Click here for pricing information and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7862
PUBLISHED: 2021-06-24
A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability is due to insufficient input santization when communicating customer process.
CVE-2021-21737
PUBLISHED: 2021-06-24
A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system application, attackers could use this vulnerability to tamper with the system desktop and affect system customization functions. This affects: ZXV10 B860H V5.0, V83011303...
CVE-2021-25923
PUBLISHED: 2021-06-24
In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.
CVE-2021-25655
PUBLISHED: 2021-06-24
A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).
CVE-2021-25656
PUBLISHED: 2021-06-24
Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).