Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


09:25 AM
Connect Directly

How Some Apple, Android Mobile Tax Apps Put Sensitive Data At Risk

A review of 29 Apple iOS and Android apps used for tax filing purposes show many are not fully secure, Appthority says.

E-filing tax returns via a smartphone can be convenient and fast, but many of the income tax-filing apps people use are not so secure.

With this year’s tax deadline looming, security vendor Appthority decided to do a quick analysis of several mobile tax applications. In all, the company reviewed 29 Android and Apple iOS tax applications for risky behaviors such as collecting and transmitting personally identifiable information, sharing location data with third parties, and transmitting sensitive tax data without encryption.

The results were a mixed a bag. On the one hand, many of the applications that Appthority reviewed have vulnerabilities that put highly sensitive user data like Social Security Numbers and earnings information, at risk. But none of them are severe enough to warn users off them altogether.

According to Appthority, the goal of the review is to alert mobile users about the potentially risky behavior of tax apps -- some of which have been developed by companies with considerable resources and development experience. “We suspect even more vulnerabilities can be found in lesser known apps which are not developed with enterprise grade resources,” the company said.

Here are some of the potential risks, organized by severity level, that Appthority identified in the mobile tax-filing apps:

1. Low-risk vulnerabilities

A total of eight mobile tax applications exhibit what Appthority describes as low-risk vulnerabilities stemming from a failure to adhere to security best practices. The most common among them are so-called full path disclosure flaws that basically enable an attacker to see the entire path to the app’s source code.

Such vulnerabilities allow a way into server-side code from the client, and can give adversaries critical information on how to attack an application. This type of vulnerability can occur when either the developer of the app or development kit used to write the app fails to delete its source code, Appthority says.

Such vulnerabilities do not pose a direct threat to users of these apps, but they can be problematic in an enterprise or government context.

Apps with this kind of vulnerability include the iOS versions of TurboTax, one of the most popular tax-filing apps; Evernote; Expensify; and IRS2Go. With many of the applications, the vulnerability exists in the source code of SDKs they use. But some apps -- Evernote, IRS2Go, and MyTaxRefund -- are vulnerable due to issues in their own source code.

2.Medium-risk flaws

A total of three apps—two of them iOS and one Android—display a combination of behaviors that Appthority determines are serious enough to put them in the medium-risk category. These behaviors include accessing privacy-invasive information on the mobile device, and not adequately encrypting sensitive data. The flaws could potentially put user data at risk in certain situations. For instance, people doing their taxes in a public Wi-Fi setting like a coffee shop could have their data intercepted and stolen as a result of weak encryption.

“If an app is transmitting information without encryption, then anyone in the same network can read and intercept that data,” says Domingo Guerra, co-founder of Appthority. “When the attacker sees a [unique device ID] go through, they could take advantage of a well-known vulnerability in TrueCaller to intercept [the ID]” and grab personal data belonging to the user, he says. “Because not all apps handle encryption correctly, users should avoid using apps that touch or transmit sensitive data when on a public or insecure Wi-Fi connection.”

Two of the applications—MyBlock and IRS2Go—landed in this category for sharing the user’s location data in the clear without any encryption. The other app with a medium-risk flaw is CPA Tax Answers Free, which Appthority faults for sending certain tax-related data unencrypted.

3. High-risk flaws.

Appthority’s highest risk category was reserved for mobile tax applications that store or transmit sensitive and personally identifiable data, including unique device identifier information, without encryption. Just three apps out of the 29 apps in the study fall into this category: the Android version of MyBlock, which transmits device ID and PII unencrypted; the Android version of Calculator for US Taxes, which sends unencrypted PII; and the iOS version of TaxBot, which transmits device ID information insecurely.

The likelihood of the flaws being exploited is relatively low, accordind to Appthority, but the company recommends avoiding public Wi-Fi and using a secure, password-protected network when filing taxes via mobile apps.

Related content:


Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Click here for pricing information and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-17
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle a...
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary we...
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPor...
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortl...
PUBLISHED: 2021-05-17
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.