Adobe fixes SDK weakness affecting mobile apps

guest · Nov 11, 2019

Adobe fixes SDK weakness affecting mobile apps
November 11, 2019
https://nakedsecurity.sophos.com/2019/11/11/adobe-fixes-sdk-weakness-affecting-mobile-apps/

Adobe has updated the sample configuration files that ship with its Experience Platform Mobile Software Development Kit (SDK) after a security company discovered insecure default settings.

All seemed well until, in March 2019, Nightwatch Cybersecurity noticed that the main app configuration file, ADBMobileConfig.json, contained settings that could lead to security problems.
Why does this matter?
Some developers have been using these configuration files inside their own apps, creating hidden problems, said Nightwatch:

When these options are used insecurely, attackers can view or modify information transmitted by the application back to Adobe’s cloud services.
This isn’t surprising – larger dev teams will craft their own configuration while smaller ones will just use what’s handed to them by Adobe, even if that makes an assumption about the settings.
Click to expand...

After being told of the issue in March, Adobe recently released an updated version of its Mobile SDK (version numbers vary by platform).
Given that there’s no evidence the issue has ever been exploited, the discovery looks like a case of trouble averted. Even so, it’s still surprising that Adobe didn’t pick up on the problem.
Click to expand...

Log in or Sign up

Adobe fixes SDK weakness affecting mobile apps

guest Guest

Log in or Sign up

Adobe fixes SDK weakness affecting mobile apps

guest Guest

Useful Searches