April 16, 2014

Google Logo Add Us On GoogleAdd SciAm

Smartphones Vulnerable to App Attack

Certain HTML5 apps that run across platforms can carry JavaScript attack codes that your smartphone will happily execute. Christopher Intagliata reports

 

By Christopher Intagliata

Illustration of a Bohr atom model spinning around the words Science Quickly with various science and medicine related icons around the text

Join Our Community of Science Lovers!

On supporting science journalism

If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.

Now that you've changed all your passwords because of the Heartbleed Bug (right?), here's something else to worry about—your smartphone might be susceptible to one of the Web's most common hacks, something called a cross-site scripting attack.

Here's how it works. Let's say you scan a 2-D bar code with your phone. The bar code contains information—including, perhaps, a string of malicious JavaScript code. If your bar code reader is a native iPhone or Android app, no problem. But if it's an HTML5 app, which works across platforms, you might be in trouble. Because HTML5 apps run on JavaScript. And some are designed to detect JavaScript in a jumble of data—like that bar code—and execute it.
 
Researchers found five bar code–scanner apps with that vulnerability in the Android marketplace and three in the iPhone app store. They'll present the results at the Mobile Security Technologies workshop in San Jose in May. [Xing Jin, Tongbo Luo, Derek G. Tsui, and Wenliang Du, XDS: Cross-Device Scripting Attacks on Smartphones through HTML5-based Apps]

HTML5 apps are forecast to dominate half the market by 2016. And since bad code can hide in mp3s, photos, texts, even the names of wi-fi networks, researchers say it's time for developers to wise-up to this glitch before it goes viral.
 
—Christopher Intagliata
 
[The above text is a transcript of this podcast.]
 

It’s Time to Stand Up for Science

If you enjoyed this article, I’d like to ask for your support. Scientific American has served as an advocate for science and industry for 180 years, and right now may be the most critical moment in that two-century history.

I’ve been a Scientific American subscriber since I was 12 years old, and it helped shape the way I look at the world. SciAm always educates and delights me, and inspires a sense of awe for our vast, beautiful universe. I hope it does that for you, too.

If you subscribe to Scientific American, you help ensure that our coverage is centered on meaningful research and discovery; that we have the resources to report on the decisions that threaten labs across the U.S.; and that we support both budding and working scientists at a time when the value of science itself too often goes unrecognized.

In return, you get essential news, captivating podcasts, brilliant infographics, can't-miss newsletters, must-watch videos, challenging games, and the science world's best writing and reporting. You can even gift someone a subscription.

There has never been a more important time for us to stand up and show why science matters. I hope you’ll support us in that mission.

Thank you,

David M. Ewalt, Editor in Chief, Scientific American

Subscribe
Smartphones Vulnerable to App Attack