It is important to pay attention to the permissions you’re granting all apps (and not just to those apps you would consider to be risky). App permissions determine what functions and data an app has access to on your device, and some are riskier than others. Some apps collect data without explicitly asking permission, while others boldly neglect user preferences entirely (like this Chinese weather app that was using certain permissions, such as location, even if users denied access).

There are variations in app permissions between iOS and Android. iOS has more privacy-focused permissions, while Android tends to expose access to raw parts of the hardware and operating system. For example, iOS has separate permissions for apps to access the camera (to take a photo) and to access the photo library. The equivalent on Android includes access to the camera (same as iOS) and access to either read or write the actual storage device (e.g., flash memory). While it is not a perfect like-for-like, reading external storage is the permission that is required to access the photo gallery on Android. We have analyzed the app permissions for both iOS and Android to see how many apps are asking for some of the most common permissions.

Public Wi-Fi presents a serious privacy risk when a Man-in-the-Middle (MitM) attack occurs. There are two primary flavors of MitM attacks that we see impacting mobile users. The first is when the attacker has physical control of network infrastructure, such as a fake Wi-Fi access point, and is able to snoop on the traffic that flows through it. The second is when the attacker tampers with the network protocol that is supposed to offer encryption, essentially exposing data that should have been protected.

Many attackers establish fake hotspots that use naming conventions similar to popular access point names. A distracted user could easily be fooled into connecting to a malicious hotspot with a convincing name.

Data leaks certainly don’t get as much attention as active threats like malware and phishing, but a leaking app is one of the biggest threats to user data privacy. By failing to encrypt data, an app or website developer is essentially making user data much more readily available to a MitM sitting on the same network as the device with the leaking app.

Our research shows that a username is exposed in 90% of PII leaks, a password is exposed in 85%, and credit card details in 2.3%. Don’t discount the implications of a password leak. Hackers can easily break into corporate accounts by capturing a user’s credentials with a MitM attack and using a tool to instantaneously plug those credentials into thousands of login pages at once. The scary reality is that using a poorly developed app on public Wi-Fi could lead to a major data breach.