Over 54 mn users' data at risk via 3 popular email marketing apps

New Delhi, Dec 19 (IANS): Three popular transactional and marketing email service providers -- Mailgun, MailChimp and Sendgrid -- have put data of more than 54 million mobile app users at risk, including from India, a report claimed on Monday.

People in the US have downloaded these apps the most, followed by the UK, Spain, Russia, and India, leaving over 54 million mobile app users vulnerable, according to cyber-security firm CloudSEK.

CloudSEK's 'BeVigil', a security search engine for mobile apps, uncovered about 50 per cent of the analysed (600) apps on the Google play store, leaking API keys of three popular transactional and marketing email service providers; Mailgun, MailChimp, and Sendgrid.

An API (application programming interface) is a piece of software that allows applications to communicate with each other without any human intervention. An API key is a special identification used by users, developers, or calling programmes to authenticate themselves to an API.

"Leaked API keys allow threat actors to perform a variety of unauthorised actions such as sending emails, deleting API keys, and modifying two-factor authentication," said security researchers.

Mailgun provides email API services enabling brands to send, validate, and receive emails through their domain at scale.

"An API key leak would allow a threat actor to send emails, read emails, get simple mail transfer protocol (SMTP) credentials, get IP address and statistics, allow creating, accessing, and deleting Webhooks and retrieve mailing lists of customers and launch a phishing campaign," said the report.

Mailchimp is a transactional email service first introduced in 2001 and later launched as a paid service with an additional freemium option in 2009.

An API key leak in Mailchimp would allow a threat actor to read conversations, fetch customer information, expose email lists of multiple campaigns containing personal identifiable information (PII), authorise third-party applications connected to a MailChimp account, manipulate promo codes and start a fake campaign and send emails on behalf of the company.

In the case of SendGrid, a communication platform intended for transactional and marketing emails, an API key leak would allow a hacker to send emails, create API keys, control IP addresses used to access accounts.

"In modern software architecture, APIs integrate new application components into existing architecture. So its security has become imperative. Software developers must avoid embedding API keys into their applications and should follow secure coding and deployment practices," said CloudSEK.



Top Stories

Leave a Comment

Title: Over 54 mn users' data at risk via 3 popular email marketing apps

You have 2000 characters left.


Please write your correct name and email address. Kindly do not post any personal, abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful or similar comments. Daijiworld.com will not be responsible for any defamatory message posted under this article.

Please note that sending false messages to insult, defame, intimidate, mislead or deceive people or to intentionally cause public disorder is punishable under law. It is obligatory on Daijiworld to provide the IP address and other details of senders of such comments, to the authority concerned upon request.

Hence, sending offensive comments using daijiworld will be purely at your own risk, and in no way will Daijiworld.com be held responsible.