CBS Sports App Left User Data Vulnerable During March Madness

CBS Sports App Left User Data Vulnerable During March Madness

  • By Sydny Shepard
  • Apr 13, 2016

Millions of college basketball fans used the CBS Sports app and website during the March Madness tournament may have had their personal information leaked by the popular sports channel due to the lack of encryption on the data.

A report by mobile data management and security firm Wandera found a data leak on the CBS Sports app (downloaded 5 million to 10 million times on Google Play and one of the top sports apps in the iTunes store) and mobile website during the tournament, which allowed for user data to be compromised.

While CBS Sports denies any kind of breach, Wandera says that they found that anyone using their mobile device on public Wi-Fi would have been exposed to the vulnerability.

The report found that both Andriod and iOS versions of the CBS Sports app and the CBS mobile website failed to protect user names, dates of birth, email addresses, account passwords in clear text and ZIP codes. Credit card and social security information was not revealed, however.

Wandera said that just because they were able to tap into that information does not mean that an attacker already has, but it is possible. CBS Sports denied the claims of a data breach and said it is rigorous about monitoring its platforms for any potential security issues.

"There was no data breach on either the CBS Sports app or mobile site," CBS Sports Digital said in a statement. "We take issue with outside companies publicizing the security operations of other firms for their own purposes rather than user protection."

Wandera says it came across the vulnerability unexpectedly while doing research on sports applications ahead of March Madness. As its engineers tracked data across multiple sports sites, they noticed data coming across its cloud service from CBS.

Once the vulnerability was discovered, CBS was immediately notified. After about a month, CBS notified Wandera that the problem had been fixed.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • It Always Rains in Florida

    Over the years, and many trips to various cities, I have experienced some of the craziest memorable things. One thing I always count on when going to Orlando is a massive rainstorm after the tradeshow has concluded the first day. Count on it, it is going to rain Monday evening. Expect that it will be a gully washer. Read Now

    • Industry Events

  • Live from GSX 2024 Preview

    It’s hard to believe, but GSX 2024 is almost here. This year’s show runs from Monday, September 23 to Wednesday, September 25 at the Orange County Convention Center in Orlando, Fla. The Campus Security Today and Security Today staff will be on hand to provide live updates about the security industry’s latest innovations, trends, and products. Whether you’re attending the show or keeping tabs on it from afar, we’ve got you covered. Make sure to follow the Live from GSX page for photos, videos, interviews, product demonstrations, announcements, commentary, and more from the heart of the show floor! Read Now

    • Industry Events

  • Elevate Your Business

    In today’s dynamic business environment, companies specializing in physical security are constantly evolving to remain competitive. One strategic shift these businesses can make to give them the advantage is a full or partial transition to a recurring revenue model, popularly called a subscription service. This approach will bring numerous benefits that not only enhance business stability but also improve customer relationships and drive innovation. Recurring monthly revenue (RMR) or recurring annual revenue (RAR) are two recurring cadence choices that work simply and effectively. Read Now

  • Playing a Crucial Role

    Physical security technology plays a crucial role in detecting and preventing insider cybersecurity threats. While it might seem like a stretch to connect physical security with cyber threats, the two are closely intertwined. Here’s how physical security technology can be leveraged to address both external and internal threats. Read Now

Most   Popular

Featured Cybersecurity

Webinars

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3