Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

4/6/2016
09:25 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

How Some Apple, Android Mobile Tax Apps Put Sensitive Data At Risk

A review of 29 Apple iOS and Android apps used for tax filing purposes show many are not fully secure, Appthority says.

E-filing tax returns via a smartphone can be convenient and fast, but many of the income tax-filing apps people use are not so secure.

With this year’s tax deadline looming, security vendor Appthority decided to do a quick analysis of several mobile tax applications. In all, the company reviewed 29 Android and Apple iOS tax applications for risky behaviors such as collecting and transmitting personally identifiable information, sharing location data with third parties, and transmitting sensitive tax data without encryption.

The results were a mixed a bag. On the one hand, many of the applications that Appthority reviewed have vulnerabilities that put highly sensitive user data like Social Security Numbers and earnings information, at risk. But none of them are severe enough to warn users off them altogether.

According to Appthority, the goal of the review is to alert mobile users about the potentially risky behavior of tax apps -- some of which have been developed by companies with considerable resources and development experience. “We suspect even more vulnerabilities can be found in lesser known apps which are not developed with enterprise grade resources,” the company said.

Here are some of the potential risks, organized by severity level, that Appthority identified in the mobile tax-filing apps:

1. Low-risk vulnerabilities

A total of eight mobile tax applications exhibit what Appthority describes as low-risk vulnerabilities stemming from a failure to adhere to security best practices. The most common among them are so-called full path disclosure flaws that basically enable an attacker to see the entire path to the app’s source code.

Such vulnerabilities allow a way into server-side code from the client, and can give adversaries critical information on how to attack an application. This type of vulnerability can occur when either the developer of the app or development kit used to write the app fails to delete its source code, Appthority says.

Such vulnerabilities do not pose a direct threat to users of these apps, but they can be problematic in an enterprise or government context.

Apps with this kind of vulnerability include the iOS versions of TurboTax, one of the most popular tax-filing apps; Evernote; Expensify; and IRS2Go. With many of the applications, the vulnerability exists in the source code of SDKs they use. But some apps -- Evernote, IRS2Go, and MyTaxRefund -- are vulnerable due to issues in their own source code.

2.Medium-risk flaws

A total of three apps—two of them iOS and one Android—display a combination of behaviors that Appthority determines are serious enough to put them in the medium-risk category. These behaviors include accessing privacy-invasive information on the mobile device, and not adequately encrypting sensitive data. The flaws could potentially put user data at risk in certain situations. For instance, people doing their taxes in a public Wi-Fi setting like a coffee shop could have their data intercepted and stolen as a result of weak encryption.

“If an app is transmitting information without encryption, then anyone in the same network can read and intercept that data,” says Domingo Guerra, co-founder of Appthority. “When the attacker sees a [unique device ID] go through, they could take advantage of a well-known vulnerability in TrueCaller to intercept [the ID]” and grab personal data belonging to the user, he says. “Because not all apps handle encryption correctly, users should avoid using apps that touch or transmit sensitive data when on a public or insecure Wi-Fi connection.”

Two of the applications—MyBlock and IRS2Go—landed in this category for sharing the user’s location data in the clear without any encryption. The other app with a medium-risk flaw is CPA Tax Answers Free, which Appthority faults for sending certain tax-related data unencrypted.

3. High-risk flaws.

Appthority’s highest risk category was reserved for mobile tax applications that store or transmit sensitive and personally identifiable data, including unique device identifier information, without encryption. Just three apps out of the 29 apps in the study fall into this category: the Android version of MyBlock, which transmits device ID and PII unencrypted; the Android version of Calculator for US Taxes, which sends unencrypted PII; and the iOS version of TaxBot, which transmits device ID information insecurely.

The likelihood of the flaws being exploited is relatively low, accordind to Appthority, but the company recommends avoiding public Wi-Fi and using a secure, password-protected network when filing taxes via mobile apps.

Related content:

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Click here for pricing information and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-18165
PUBLISHED: 2021-05-12
Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu".
CVE-2020-19275
PUBLISHED: 2021-05-12
An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will leak the physical path.
CVE-2021-29511
PUBLISHED: 2021-05-12
evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making it possible for an attacker to perform d...
CVE-2020-19274
PUBLISHED: 2021-05-12
A Cross SIte Scripting (XSS) vulnerability exists in Dhcms 2017-09-18 in guestbook via the message board, which could let a remote malicious user execute arbitrary code.
CVE-2021-30211
PUBLISHED: 2021-05-12
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter.