Companies scramble to fix lack of encryption on mobile apps

Their mobile apps were transmitting payment card information without encryption

Several companies have moved quickly to add encryption to their mobile apps after it was discovered they failied to encrypt payment card information in transit, putting users at risk.

The apps were not using SSL/TLS (Secure Sockets Layer/Transport Layer Security), an encryption protocol that scrambles data as it's sent across the Internet, according to Wandera, a cloud and mobile security vendor.

"With so many breaches and costly data loss incidents in the news, it's hard to believe that any business would fail to take such a basic precaution as to encrypt sensitive traffic as it's transmitted to or from a website," said Michael J. Covington, senior product manager, in a video posted Wednesday.

Data breaches can be costly for companies, and how to better protect payment card information has been a big question after major breaches at retailers including Target, Home Depot and many others.

Five of the 16 companies named by Wandera in a blog post have now fixed their problems, including easyJet, Chiltern Railways, San Diego Zoo, CN Tower and Aer Lingus, a Wandera spokeswoman said Wednesday. All of the companies were notified of the issue by Wandera, which estimates they collectively serve 500,000 customers a day.

The company detected the problems while analyzing traffic flows of customers that use its mobile security app and gateway technology.

Using SSL/TLS when transmitting information such as login credentials, personal information and payment card data is considered standard practice to guard against breaches. Encrypted connections are typically signified in the browser URL bar by a padlock icon and "https."

If the data is not encrypted, someone on the same network -- such as a public Wi-Fi hotspot -- could collect the traffic and see the information in plain text.

Covington said in some cases the primary websites did use encryption, but the same services were not protected when using mobile browsers or apps.

Mobile apps often have multiple connections to backend services, and all need to be treated with the same protection, Covington said.

In January, Wandera found that the National Football League's mobile app leaked usernames and passwords due to an unencrypted API (application programming interface) call, according to an advisory. The problem was later fixed.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?