Leaked pet apps pose privacy and cybersecurity threats

Is it worth exposing your personal data in exchange for the convenience of using pet apps on your smartphone?

Pet apps that leak your sensitive information probably haven’t been a topic of attention for you. But that may be the case now, thanks to two recent studies presented at the IEEE European Symposium on Security and Privacy Workshops 2022.

Computer scientists from Newcastle University and the University of London’s Royal Holloway exposed multiple security and privacy concerns on February 28. Researchers from both universities evaluated popular Android apps for pets and other pets, as well as farm animals. They found 40 user information leaks.

Dubbed pet technology, pet industry developers are using technology to improve the health, well-being, and overall quality of life of pets. Apparently, they also use it as a data acquisition source that endangers user safety.

Pet technology is growing and includes a wide range of products including GPS trackers, automatic feeders and pet cameras, according to a written statement from Newcastle University. Other examples of pet technology include wearable devices that monitor an animal’s activity levels, heart rate, and sleep patterns.

Some of these pet apps control smart feeding systems that dispense food on a set schedule or in response to pet behavior. These apps and platforms also allow owners to track and manage their pets’ health records and connect with veterinary professionals.

The problem of leaking apps is widespread, far beyond pet apps, according to Ashish Patel, GM/EMEA of mobile security solutions company Zimperium.

The problem is evident in all markets, countries and applications. It involves sharing unencrypted information in clear text and sharing data on cloud-based open servers.

“It’s an issue that’s coming to the fore now, but we’re seeing more and more organizations apply security from development, with technologies digitizing application development to produce more secure applications, to making sure the app is obfuscated, the keys are encrypted, and it’s also equally important that it’s running on a secure (not hacked) device with execution protection, Patel told TechNewsWorld

What researchers found in pet apps

The researchers did not disclose the names of the pet apps they analyzed. They also did not specify what kind of content was leaked from specific apps.

However, they verified that the apps sent developers sensitive user information, including email addresses, location data and pet details, without encryption or user consent.

Many of these apps put users at risk by exposing their login or location information.

Three apps had users’ login information visible in plain text in unsecured HTTP traffic, which means anyone can observe the Internet traffic of someone using one of these apps and can find their login information. connection, according to the Newcastle University statement.

Additionally, two of the apps also displayed details about users, such as their location. This can allow someone to access their devices and risk a cyberattack.

Tracking software built into four apps has raised another concern: Trackers can collect user data related to how they use the app or smartphone.

The analysis showed that 21 apps track users before consent, breaking current data protection regulations.

Researcher Privacy and Security Disclaimers

Scott Harper, a Ph.D. student at Newcastle University’s School of Computing and lead author of the study, noted that pet tech products, such as smart collars and GPS trackers, are a rapidly growing industry. This brings new security, privacy and safety risks for pet owners.

“While owners can use these apps to get peace of mind about their dog’s health or where their cat is, they may not be happy to discover the risks the apps pose to their cybersecurity. “, he offered in the statement of the university.

Harper urged users to make sure they set up unique passwords, check settings and think about how much data they’re willing to share.

Report co-author Dr Maryam Mehrnezhad, from the Department of Information Security at Royal Holloway, University of London, added that using modern technologies to improve several aspects of our lives often involves good technologies. market that come at the expense of user privacy, safety, and security.

“Animal technologies can create complex risks and harms that are not easy to recognize and manage. In this interdisciplinary project, we are working on solutions to mitigate these risks and allow pet owners to use these technologies without risk or fear,” she said.

Second study shows user complacency

The research team conducted a second study with 600 participants from the UK, US and Germany. They questioned the technologies used, the incidents that occurred and the methods used to protect their online security and privacy in general and in pet apps in particular. The researchers published the survey results in the journal Proceedings of the 12th International Conference on the Internet of Things. Their results revealed that participants believe a range of attacks can occur targeting their pet technology.

Despite this concern, respondents said they take few precautions to protect themselves and their pets from the risks and possible harms of these technologies. The university’s statement did not disclose numerical results.

“We urge those who develop these technologies to increase the security of these devices and applications to reduce the risk of sharing their personal information or location,” offered co-author Dr. Matt Leach, director of the Center for Comparative Biology from the University of Newcastle.

Internal cybersecurity reactions

According to Casey Ellis, founder and CTO of cybersecurity firm Bugcrowd, app developers, especially for apps that aren’t “security first” in nature, often prioritize functionality and usability over security in a rush to differentiate themselves in the market. Speed ​​is the natural enemy of security, which is why fast-to-market domains such as mobile apps encounter such issues quite frequently.

“Ultimately, (the vulnerabilities vary and) come down to the risk to the individual user. For example, for some people, a privacy breach might not seem so serious. an immediate personal safety concern,” Ellis told TechNewsWorld.

Either way, app developers need to ensure security and privacy controls behave as the user intended, which is clearly not a consistent theme here, he said. added.

App users should understand that if they are not paying for an app or service, they are the product. Your data and usage is how the company will make money, warned Zane Bond, product manager at cybersecurity software company Keeper Security.

“Be aware of this and understand that most services are not free. You just don’t realize the initial cost. Even with many paid services, your data is still for sale,” Bond told TechNewsWorld.