Menu
Companies scramble to fix lack of encryption on mobile apps

Companies scramble to fix lack of encryption on mobile apps

Their mobile apps were transmitting payment card information without encryption

Several companies have moved quickly to add encryption to their mobile apps after it was discovered they failied to encrypt payment card information in transit, putting users at risk.

The apps were not using SSL/TLS (Secure Sockets Layer/Transport Layer Security), an encryption protocol that scrambles data as it's sent across the Internet, according to Wandera, a cloud and mobile security vendor.

"With so many breaches and costly data loss incidents in the news, it's hard to believe that any business would fail to take such a basic precaution as to encrypt sensitive traffic as it's transmitted to or from a website," said Michael J. Covington, senior product manager, in a video posted Wednesday.

Data breaches can be costly for companies, and how to better protect payment card information has been a big question after major breaches at retailers including Target, Home Depot and many others.

Five of the 16 companies named by Wandera in a blog post have now fixed their problems, including easyJet, Chiltern Railways, San Diego Zoo, CN Tower and Aer Lingus, a Wandera spokeswoman said Wednesday. All of the companies were notified of the issue by Wandera, which estimates they collectively serve 500,000 customers a day.

The company detected the problems while analyzing traffic flows of customers that use its mobile security app and gateway technology.

Using SSL/TLS when transmitting information such as login credentials, personal information and payment card data is considered standard practice to guard against breaches. Encrypted connections are typically signified in the browser URL bar by a padlock icon and "https."

If the data is not encrypted, someone on the same network -- such as a public Wi-Fi hotspot -- could collect the traffic and see the information in plain text.

Covington said in some cases the primary websites did use encryption, but the same services were not protected when using mobile browsers or apps.

Mobile apps often have multiple connections to backend services, and all need to be treated with the same protection, Covington said.

In January, Wandera found that the National Football League's mobile app leaked usernames and passwords due to an unencrypted API (application programming interface) call, according to an advisory. The problem was later fixed.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Why experience is the new battleground for partners

Join us for an exclusive webinar, in association with Hewlett Packard Enterprise and Technology Services Industry Association (TSIA) and learn about the latest industry insights and how technology services continue to evolve to deliver differentiated value, and how partners can be successful in 2021 and beyond.

Featured

Slideshows

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

The leading female front runners of the New Zealand ICT industry joined together for the annual Reseller News Women in ICT Awards event at the Hilton in Auckland, during which hundreds of guests celebrated 13 outstanding individuals who won awards, chosen from more than 50 finalists representing over 30 organisations.

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards
Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

More than 500 channel leaders gathered in Auckland on 21 October at the ​Reseller News Innovation Awards ​2020 to celebrate the achievements of the New Zealand technology industry's top partners, start-ups, vendors, distributors and individuals.

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners
Show Comments