CBS Sports App Left User Data Vulnerable During March Madness
- By Sydny Shepard
- Apr 13, 2016
Millions of college basketball fans used the CBS Sports app and website during the March Madness tournament may have had their personal information leaked by the popular sports channel due to the lack of encryption on the data.
A report by mobile data management and security firm Wandera found a data leak on the CBS Sports app (downloaded 5 million to 10 million times on Google Play and one of the top sports apps in the iTunes store) and mobile website during the tournament, which allowed for user data to be compromised.
While CBS Sports denies any kind of breach, Wandera says that they found that anyone using their mobile device on public Wi-Fi would have been exposed to the vulnerability.
The report found that both Andriod and iOS versions of the CBS Sports app and the CBS mobile website failed to protect user names, dates of birth, email addresses, account passwords in clear text and ZIP codes. Credit card and social security information was not revealed, however.
Wandera said that just because they were able to tap into that information does not mean that an attacker already has, but it is possible. CBS Sports denied the claims of a data breach and said it is rigorous about monitoring its platforms for any potential security issues.
"There was no data breach on either the CBS Sports app or mobile site," CBS Sports Digital said in a statement. "We take issue with outside companies publicizing the security operations of other firms for their own purposes rather than user protection."
Wandera says it came across the vulnerability unexpectedly while doing research on sports applications ahead of March Madness. As its engineers tracked data across multiple sports sites, they noticed data coming across its cloud service from CBS.
Once the vulnerability was discovered, CBS was immediately notified. After about a month, CBS notified Wandera that the problem had been fixed.
About the Author
Sydny Shepard is the Executive Editor of Campus Security & Life Safety.