How Some Apple, Android Mobile Tax Apps Put Sensitive Data At Risk

E-filing tax returns via a smartphone can be convenient and fast, but many of the income tax-filing apps people use are not so secure.

With this year’s tax deadline looming, security vendor Appthority decided to do a quick analysis of several mobile tax applications. In all, the company reviewed 29 Android and Apple iOS tax applications for risky behaviors such as collecting and transmitting personally identifiable information, sharing location data with third parties, and transmitting sensitive tax data without encryption.

The results were a mixed a bag. On the one hand, many of the applications that Appthority reviewed have vulnerabilities that put highly sensitive user data like Social Security Numbers and earnings information, at risk. But none of them are severe enough to warn users off them altogether.

According to Appthority, the goal of the review is to alert mobile users about the potentially risky behavior of tax apps -- some of which have been developed by companies with considerable resources and development experience. “We suspect even more vulnerabilities can be found in lesser known apps which are not developed with enterprise grade resources,” the company said.

Here are some of the potential risks, organized by severity level, that Appthority identified in the mobile tax-filing apps:

1. Low-risk vulnerabilities

A total of eight mobile tax applications exhibit what Appthority describes as low-risk vulnerabilities stemming from a failure to adhere to security best practices. The most common among them are so-called full path disclosure flaws that basically enable an attacker to see the entire path to the app’s source code.

Such vulnerabilities allow a way into server-side code from the client, and can give adversaries critical information on how to attack an application. This type of vulnerability can occur when either the developer of the app or development kit used to write the app fails to delete its source code, Appthority says.

Such vulnerabilities do not pose a direct threat to users of these apps, but they can be problematic in an enterprise or government context.

Apps with this kind of vulnerability include the iOS versions of TurboTax, one of the most popular tax-filing apps; Evernote; Expensify; and IRS2Go. With many of the applications, the vulnerability exists in the source code of SDKs they use. But some apps -- Evernote, IRS2Go, and MyTaxRefund -- are vulnerable due to issues in their own source code.

2.Medium-risk flaws

A total of three apps—two of them iOS and one Android—display a combination of behaviors that Appthority determines are serious enough to put them in the medium-risk category. These behaviors include accessing privacy-invasive information on the mobile device, and not adequately encrypting sensitive data. The flaws could potentially put user data at risk in certain situations. For instance, people doing their taxes in a public Wi-Fi setting like a coffee shop could have their data intercepted and stolen as a result of weak encryption.

“If an app is transmitting information without encryption, then anyone in the same network can read and intercept that data,” says Domingo Guerra, co-founder of Appthority. “When the attacker sees a [unique device ID] go through, they could take advantage of a well-known vulnerability in TrueCaller to intercept [the ID]” and grab personal data belonging to the user, he says. “Because not all apps handle encryption correctly, users should avoid using apps that touch or transmit sensitive data when on a public or insecure Wi-Fi connection.”

Two of the applications—MyBlock and IRS2Go—landed in this category for sharing the user’s location data in the clear without any encryption. The other app with a medium-risk flaw is CPA Tax Answers Free, which Appthority faults for sending certain tax-related data unencrypted.

3. High-risk flaws.

Appthority’s highest risk category was reserved for mobile tax applications that store or transmit sensitive and personally identifiable data, including unique device identifier information, without encryption. Just three apps out of the 29 apps in the study fall into this category: the Android version of MyBlock, which transmits device ID and PII unencrypted; the Android version of Calculator for US Taxes, which sends unencrypted PII; and the iOS version of TaxBot, which transmits device ID information insecurely.

The likelihood of the flaws being exploited is relatively low, accordind to Appthority, but the company recommends avoiding public Wi-Fi and using a secure, password-protected network when filing taxes via mobile apps.

Related content:

Find out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Click here for pricing information and to register.