Major Password vulnerability in multiple Android and iOS apps.

[DaveB]

Time to check your apps. Not specific to Andoid or iOS, just specific to sloppy development.

https://appbugs.co/html/bugs_categor...ord_bruteforce

AppBugs found 53 mobile apps (Android and iOS, approximately 600 million users impacted) have the password brute force issues in their web services and attackers can exploit the holes immediately to steal users passwords.

[TheFaQQer]

3 Apps found 2 more OK

[xoggoth]

Had one on my Android tablet. A file manager.

PS That android Appbugs Security Scan logo looks amazingly similar to my android app, also about bugs. With a bit of luck people will get mixed up and install mine by mistake.

https://play.google.com/store/apps/d...com.appbugs.ui

https://play.google.com/store/apps/d....ISee.LandBugs

[NickFitz]

These appear to be vulnerabilities in the HTTP APIs, not in the apps at all. The apps are just client software that uses the relevant HTTP endpoint.

[DaveB]

These appear to be vulnerabilities in the HTTP APIs, not in the apps at all. The apps are just client software that uses the relevant HTTP endpoint.

Yes, as per the original post, the apps are making use of vulnerable web services. The net effect is still that passwords used by or with the apps are vulnerable to brute force attacks without the app owners knowledge.