Lack of developer attention to cloud security prompts alerts

“As the end result is information leakage, which also includes credentials, one thing users have control over is good password hygiene,” said Amin.

“Users can protect themselves to a certain degree by any of the following: not reusing passwords; not using passwords with obvious patterns; keeping an eye out for messages from other services they use on login attempts, password reset attempts or account recovery attempts; ask the application owner to support passwordless options, ask the application developer to support native on-device biometrics, look for alternate applications that have stated security and privacy practices, ask Google and Apple to do more due diligence on the back-end security of the applications they allow on their marketplace.”

Tom Lysemose Hansen, chief technology officer at Norway-based app security firm Promon, said Check Point’s findings were, on the whole, disappointing, as they highlighted “rookie errors” in the developer community.

“While it would be unfair to expect someone to never make a mistake, this is more than just a one-off. App data should always be protected. It’s as simple as that. Not obfuscated or hidden away, but protected,” he said.

“Accessing user messages is bad enough, but that’s not the worst of it. Should an attacker find a way to access API keys, for example, they can easily extract them and build fake apps that impersonate the real ones to make arbitrary API calls, or otherwise access an app’s back-end infrastructure to scrape information from servers.

“These types of attacks can result in serious data breaches and, aside from the associated fines, can have damaging effects on brand reputation,” added Hansen.

Trevor Morgan, product manager at comforte AG, said the increased attack surface allowed for by cloud environments made security harder for the companies that rely on them.

“With a hybrid and multicloud strategy, data becomes dispersed across multiple clouds as well as their own datacentres. Data security becomes even more difficult to manage as cloud infrastructure complexity grows,” he said.

“Combined with a modern DevOps culture, misconfigurations and general security requirements that are overlooked or flat-out ignored are becoming commonplace,” he said.

“Combined with a modern DevOps culture, misconfigurations and general security requirements that are overlooked or flat-out ignored are becoming commonplace”