0

I'm wondering how apps that leak personally identifiable information can be taken advantage of by hackers? How would they have the infrastructure to capture all that information that come from thousands of users?

I'm asking because when analyzing applications, the hacker/analyzer will be the one setting up the network (think MITM attacks) and in control, how does that apply to large scale operations if you are a not government institution or the ISP?

I'm guessing that the ISP or a government institution will able to take advantage (please correct me if I'm wrong).

schroeder
  • 123,438
  • 55
  • 284
  • 319
Jax
  • 3
  • 1
  • 1
    Why are you assuming that it is difficult to store data from thousands of users (a Terabyte drive is $50) and why do you think that hackers gather it all wholesale and do not mine a single target? – schroeder Dec 01 '20 at 10:45
  • Storing is the easy part, I was asking about how they will have access to the whole user base? They can do both, I was interested in the bulk collection part because that seemed more challenging @schroeder – Jax Dec 01 '20 at 10:50
  • What do you mean by "access to the whole user base"? – schroeder Dec 01 '20 at 10:53
  • the whole data collected by the app, @schroeder – Jax Dec 01 '20 at 11:41
  • Are you imaging that hackers get access to all users all at once? – schroeder Dec 01 '20 at 12:25
  • What I'm getting at, and what MechMK1's answer is getting at is: define "leak". There are tons of different types and for each type there are different approaches. There is not a simple answer to the very broad thing you've asked. If you can refine it, then a better answer can be provided. – schroeder Dec 01 '20 at 12:29
  • It's like asking: There is a shoe store. How can I steal from it?" – schroeder Dec 01 '20 at 12:30

1 Answers1

0

That depends a lot on the nature of the leak.

First of all, "leaking" private information can sometimes be a misnomer. "Leaking" implies that it is happening on accident, though many applications actually harvest personal information by design.

Let's take an imaginary game on Android an iOS as an example. When you first start the game, it asks you to give it all permissions, and I guarantee you, a bunch of people will just click "allow". The application then regularly creates a HTTPS connection to the developer's server and uploads whatever private information it can get its hands on - contact info, clipboard content, private files, etc...

As a hacker, you could hope that the application is written badly and doesn't stop when a certificate error is encountered. In that case, a Man-in-the-Middle attack can be used to intercept and copy that data. Is this something that's feasible to do on a large scale? Probably not. It's not an attack that can be done passively either, so any ISP or government involvement (as you mentioned above) should better be worth it.

Some applications however do indeed "leak" private data. They could use plain HTTP with no encryption, or "custom military-grade impenetrable encryption algorithms" (better known as "Dave's protocol"), which then allow attackers to sniff data with relative ease.

Other applications contain flaws within the application itself, which allow attackers to gather personal information, such as SQL Injection attacks or Oracle attacks. In this case, gathering the data is just a matter of time.

The exact setup will depend on the kind of leak. Sometimes setting up an attack simply isn't feasible, as the cost would exceed the expected gain. Sometimes an attacker may only be interested in one specific, high-value target (think politicians, celebrities, etc.), in which case they could go considerable lengths to exploit this vulnerability. Sometimes all they need to do is download data and store it for sale or later use.

  • Great answer, it's what I was looking for. Now, I'm wondering about the "which then allow attackers to sniff data with relative ease" part, don't they have to on the same network or at what point would they be sniffing? Again for the bulk collection part. – Jax Dec 01 '20 at 11:40
  • Yeah, they would have to be on the same network, or anywhere else along the route of the packets. But setting up "Free Starbucks Wifi" an afternoon long can yield good results if the app is popular enough. –  Dec 01 '20 at 11:43
  • Laptop and cap guy in the corner. – Jax Dec 01 '20 at 12:24
  • @Jax That would be way too obvious. Put a Raspberry Pi into your backpack and dress casually. Bring a friend, if you have one, and have a casual chat –  Dec 01 '20 at 12:41
  • I do have a Raspberry Pi... Hmmm.... – Jax Dec 03 '20 at 07:45
  • @Jax Of course, doing that is illegal - but that's what a Black Hat could do –  Dec 03 '20 at 10:27
  • ofc it is. worse I would guess. – Jax Dec 06 '20 at 06:22