The White House's New App Is Riddled With Cybersecurity Vulnerabilities, researchers say

essentialsaltes said:

Cybersecurity researchers warn that the White House’s new app regularly shares users’ IP addresses, time zones and other data to third-party services. But most of its users wouldn’t know that, because the app doesn’t disclose its data sharing the way most others do.

“The U.S. government’s infrastructure is being attacked from all sides right now, and having an amateur WordPress developer running the White House’s public presence puts everybody who visits it at risk,” Philip Fields, a cybersecurity researcher and former FBI intelligence analyst, told NOTUS. “If this were just some random app out on the App Store representing whatever small business … this would not be a story.”

--
More reporting on the above reporting:

Trump’s New App Has a Blank Privacy Policy and Uses Software From a Russia-Founded Company​

"It seems to be sharing quite a lot of data about the users to these third parties,” a researcher told NOTUS. “The problem is that the privacy manifest says they do not share that information, but in fact they do. … That is a problem for end-user privacy because effectively, they’re misleading users about how their data is shared.”

A White House press release promoted the launch of its “powerful new official mobile app — delivering President Donald J. Trump and his Administration directly to the American people like never before.”

[Certainly a lack of transparency and slip-shod execution is a hallmark of Trump and his Administration. Download the app for more of it!]

Click to expand...

The app ranks as the third-most downloaded news app in the Apple App Store as of Friday. The White House released the app last week, and Trump on Monday promoted it as a source for “front-row access to all news from your favorite president.” He encouraged all of his fans to download it.

Click to expand...

essentialsaltes said:

Recall that this app is clearly just a political thing that serves up pro-Trump messaging that was intended for people in the public who want to sign up for that sort of thing.

Recall also the security concerns above (and below).

The White House is ordering agencies to place its new app on all employees’ government phones​

The newly created, often overtly political app places the Trump administration into unprecedented and “dangerous” territory, IT experts say.​

The White House recently unveiled a new app to give the public “unfiltered” access to “key priorities,” “historic moments” and “policy breakthroughs.” Now, it’s directing agencies to help install it on the government phones of federal employees.

The Trump administration launched the app, which promises to “[keep] you connected to President Donald J. Trump and his administration like never before,” in March.

A button [in the app] gives the option to “text President Trump,” which, when clicked, opens a text message to a pre-selected number with the default text “Greatest President Ever!” Sending the text signs the user up for alerts, which individuals can also do through the app itself.

The push to install the app on the devices of millions of government employees drew surprise from current and former federal officials, who called the move highly unusual and even dangerous.

Cybersecurity researchers warned about vulnerabilities in the app soon after it debuted, like how it shares the IP addresses, time zones and other data of users with third-party services. [this potentially could provide backdoor access to government systems]

While the instructions to install the administration’s app on government phones may sound like a way to simply communicate with the government workforce more directly, “this isn’t really operational,” former government tech official David Nesting told Government Executive, pointing to the fact that it’s the same app available to the general public.

“It's just making sure all federal employees are forced to see the same propaganda they push out to the public,” said Nesting

Click to expand...