Appthority Report Looks at Risky Business from the Top 50 Apps

By Peter Bernstein February 27, 2013

At the RSA event in San Francisco the good news is that their halls and session rooms have been packed. And, as you can see there has been no shortage of news about exciting new capabilities on areas ranging from online services that give better threat visibility, to solutions for stronger identification and access management, and lots of activity surrounding what to do about detecting and defending against advanced persistent threats (ATPs) and distributed denial of service (DDoS) attacks, which continue to make headlines around the world. 

There has also be a concentration on the emerging issue created by the bring your own device (BYOD) phenomena about how secure apps are, especially surrounding those employees who are using on their personal devices when they are at work. Well Appthority, whose cloud-based Appthority Platform can automatically quantify the enterprise risk of apps by identifying malware and risky behaviors of public and private apps and determine which apps are safe for each job role based on risk profiles, is out with its newest App Report.   

Appthority’s security team used its cloud-based Appthority Platform to analyze the top 50 free apps from Apple’s App Store and Google Play for risky app behaviors.  The reason for looking at free apps is that they are the most likely to be sharing data with third-parties and/or leaking data than paid ones, along with the fact that they also are obviously extremely popular.

The report examines the differences between the Android and iOS app ecosystems, and compares app behaviors across five popular app categories (business, education, entertainment, finance, games). It also looks at the developers behind these apps.

As Appthority says, in why it produces the report, “The user should be armed with the knowledge of what apps actually do and have the choice to opt in to app permissions. Enterprises must also be aware of the risks posed by employee mobile devices when they’re used for work purposes. As employees bring new apps into the workplace, they’re putting company data and the networks these devices access at risk.”

Highlights from the App Reputation Report include:

  • 96 percent of total apps share data with advertising networks and/or analytics companies.
  • 79 percent of the top 50 free iOS and Android apps are associated with risky behaviors or privacy issues. Overall, iOS apps exhibited more risky behaviors than Android apps.
  • Entertainment apps were the worst offenders out of the top five categories, with the highest number of apps that track for location and share data with advertising networks and/or analytics companies.
  • More than half of the total apps track for location by accessing the device GPS or using other location tracking methods.
  • Another highlight is despite all the press about Android being less secure than iOS apps in terms of posing possible threats when brought into the enterprise, the opposite is true.

One section of the report is worth a pull out here. Appthority found that overall, entertainment apps exhibited the highest number of risky behaviors, particularly in terms of tracking the user’s location and sharing data with ad networks and analytics companies. Plus, none of the top business apps accessed the user’s calendar while many of the free ones do.  

The below chart may give you a reason to pause the next time you wish to download a free app in terms of the things it can do without your permission or knowledge.

Source: Appthority

There are a lot more great nuggets of information in the full report. But, there certainly is an area of chief security officer (CSO) concern, and while there are solutions that are quite good at revealing vulnerabilities, the report does highlight the old saying that “an educated consumer is the best customer.” It finally highlights that the fact that security needs to be looked at holistically in a BYOD world and that the things that need to be protected are people, processes, devices, apps and the networks they interact with. Apps are a critical part of the equation, and reports such as these in many ways should serve as a call to action.




Edited by Brooke Neuman
SHARE THIS ARTICLE
Related Articles

Apple, Cisco Join Forces - What It Could Mean for Them, and the Rest of Us

By: Paula Bernier    9/2/2015

Tech powerhouses Apple and Cisco systems this week announced they have joined forces to give business users of iOS devices the best possible experienc…

Read More

LTE Broadcast, IndyCar Racing, and Blending the Best of TV and Stadium Viewing

By: Rob Enderle    9/1/2015

This last weekend I was at the IndyCar race in Sonoma to see Verizon and Qualcomm showcase LTE Broadcast-I also wanted to see the race. I've watched N…

Read More

Windows 95 to Windows 10: How Far We Have Come in 20 Years

By: Rob Enderle    9/1/2015

Last week was the anniversary of Windows 95, which was actually a life-changing launch for me. I'd just started out as an analyst, and Windows 95 was …

Read More

Microsoft Research Project Allows for Inexpensive 3D Scanning from a Smartphone

By: Christopher Mohr    8/27/2015

It is now possible to perform 3D scanning from a smartphone, without additional hardware or an Internet connection, thanks to a new Microsoft Research…

Read More

Amazon's Scaled Back Consumer Device Efforts, Dash Button, and More

By: Paula Bernier    8/27/2015

Word is that Amazon is scaling way back on its consumer devices efforts, having let go of dozens of Lab126 engineers who worked on its Fire phone, acc…

Read More