After being notified of the regression, the AFNetworking developer released version 2.5.3, but SourceDNA said that many apps remain vulnerable.<\/p>\n
It added that its online service, Searchlight<\/a><\/strong>, was\u00a0updated to show which apps remain vulnerable.<\/p>\n SourceDNA\u2019s site suggests that a number of locally-developed applications are vulnerable.<\/p>\n Among the apps listed as affected by the security flaw are:<\/p>\n SnapScan and Zapper said their apps were incorrectly flagged.<\/p>\n SnapScan<\/p><\/div>\n SnapScan boss Kobus Ehlers said their app is secure and that it was not affected by the first or second flaw found in AFNetworking.<\/p>\n \u201cAlthough we do not have detailed insight into [SourceDNA\u2019s] detection mechanisms, we can confirm that we are not using either of the affected versions of this package (2.5.1 or 2.5.2),\u201d Ehlers said.<\/p>\n Absa<\/p><\/div>\n Absa provided similar feedback, saying that it regularly conducts thorough technical tests on its apps, including the Homeowner app.<\/p>\n Like SnapScan, the Homeowner app does not version 2.5.1 or 2.5.2 of AFNetworking, Absa said.<\/p>\n Zapper<\/p><\/div>\n Zapper said it\u00a0does use AFNetworking in their stack, but added that it\u00a0is\u00a0not affected as\u00a0it\u00a0uses alternative patterns to manage encrypted communication.<\/p>\n \u201cWe update our application regularly and have applied the updated fix to our version of the AFNetworking already queued for release pending approval from the Apple App store,\u201d said Zapper head Derek Wiggill.<\/p>\n Other companies confirmed they are aware of the issue, and are either working on it or have already submitted a fix.<\/p>\n Spokespeople for 22seven<\/strong> and BitX<\/strong> said they have already submitted new versions of their apps and are waiting for approval from Apple.<\/p>\n Zomato<\/strong> said it will be submitting an updated build of its app within 48 hours.<\/p>\n Standard Bank<\/strong> said that the need for a one-time PIN to perform transactions\u00a0mitigates some of the risk posed by the bug in AFNetworking, but added that it\u00a0will be submitting a version of its app that uses certificate pinning to Apple.<\/p>\n Discovery, DStv, and Ster-Kinekor said\u00a0they\u00a0were working on a response, while Takealot, and Mxit did not respond by the time of publication.<\/p>\n It is not only South African apps that were affected by this issue.<\/p>\n Other apps affected included Uber, Snapchat, Viber, Mailbox (by Dropbox), Microsoft OneDrive, and\u00a0“secure”\u00a0messaging service Telegram.<\/p>\n SourceDNA’s report only lists version 2.9.4 of Telegram, though, while version 2.12 is available in the App Store.<\/p>\n WhatsApp was not listed as affected.<\/p>\n Though there is a small chance that a hacker would use such a targeted attack to randomly harvest private data, users\u00a0are advised not to use any apps left vulnerable by this bug on public Wi-Fi hotspots.<\/p>\n Updates:<\/strong> Absa provided comment following the publication of this article, saying that its homeowner app was not affected. Standard Bank has also\u00a0given feedback, saying that it\u00a0will be submitting a version of its banking app that includes certificate pinning.<\/p>\n Thanks to Gerd Naschenweng for the tip.<\/p>\n Massive security flaw leaves iOS apps open to hacking<\/strong><\/a><\/p>\n Wi-Fi hacking quadcopter from SA security firm<\/strong><\/a><\/p>\n How techies, hackers swiped SA tax money<\/strong><\/a><\/p>\nSouth African financial, social apps vulnerable<\/h3>\n
\n
![\"SnapScan](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2015\/04\/SnapScan-SnapBeacons.jpg\"){kind=tracking}
<\/a>![\"Absa](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/04\/Absa-Apple.png\")
<\/a>![\"Zapper\"](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2015\/04\/Zapper.jpg\" "\\"Zapper\\"")
<\/a>What can you do?<\/h3>\n
More information security news<\/h3>\n