Starbucks app leaves passwords unencrypted and users at risk

A security researcher identified a problem with the US version of the app - it's thought that the UK version suffers from a similar flaw

Update: Starbucks say they have since updated the app to offer "extra layers of protection", with a spokesperson for the company stating that "We have no indication that any customer has been impacted by this or that any information has been compromised."

A Starbucks app used for in-store payment may be vulnerable to hackers, according to new research by an American computer security specialist.

The Starbucks card mobile app, launched in 2009, allows users to pay for orders with their mobile devices via a Starbucks Card. To pay, users of the app just need to scan the app’s barcode.

Daniel Wood, an expert in computer security, published the results of his research this week. His findings revealed that the iOS app stored customer’s usernames, passwords, and email addresses in clear text.

This means that if a hacker connected a phone to a computer and viewed the crash log, they would be able to access your username and password. Daniel Wood, in an interview with Computerworld, said that the passcode lock on an iPhone would offer no protection as “You don’t need a user’s PIN in order to pull raw data off the phone”.

With access to the username and password, hackers would be able to charge purchases in Starbucks using the app until the pre-loaded amount of money ran out. However, it is possible for customers to activate a setting on the app that auto-replenishes their balance on the app. Hackers could consequently repeatedly withdraw funds from the user’s bank account to the app.

Thankfully, according to Starbuck’s Chief Digital Officer Adam Brotman who spoke to Computerworld, the coffee company sends a message to the user if there is a request for more money, thus alerting the customer.

The UK edition of the Starbucks app.

It has not yet been confirmed whether the UK app has the same security issue. However, Daniel Wood told The Independent that he believed the UK app would be affected by the same problem “if the application is the same and just using the GB localisation file”. 

He added: “Language localisation should not change app functionality. I have not attempted to access the UK App Store personally to test this, however, the app published dates are the same for the US and UK app so that leads me to believe they are the same version”.

A spokesperson for Starbucks told The Independent: “Our customers’ security is of the utmost importance to us, and we actively monitor for risks and vulnerabilities. While we are aware of this report, there is no known impact to our customers.”

“To further mitigate our customers’ potential risk from these theoretical vulnerabilities, Starbucks has taken additional steps to safeguard any sensitive information that might have been transmitted in this way.”

It is not yet known what changes Starbucks have made and it is believed that the app must be updated in order to remove the security flaw. The same version of the app that Daniel Wood tested, version 2.6.1, is version still listed as the most recent version available on the UK App store – and has not been updated since May 2013.

Life and Style
ebookNow available in paperback
ebooks
ebookPart of The Independent’s new eBook series The Great Composers
News
Leah Devine is only the ninth female to have made the Young Magician of the Year final since the contest began more than 50 years
peopleMeet the 16-year-old who has set her heart on being the first female to win Young Magician of the Year
News
Jonathan Anderson was born in Northern Ireland but now based between London, where he presents a line named JW Anderson
peopleBritish designer Jonathan Anderson is putting his stamp on venerable house Loewe
News
Andy Davidhazy at the beginning (left) and end (right) of his hike
video
News
Taylor Swift is applying to trademark song lyrics from 1989
people
Voices
The popularity of TV shows such as The Liver Birds encouraged Liverpudlians to exaggerate their Scouse accent
voicesWe exaggerate regional traits and turn them into jokes - and those on the receiving end are in on it too, says DJ Taylor
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Recruitment Genius: Junior Web Designer - Client Liaison

    £6 per hour: Recruitment Genius: This is an exciting opportunity to join a gro...

    Recruitment Genius: Service Delivery Manager

    Negotiable: Recruitment Genius: A Service Delivery Manager is required to join...

    Recruitment Genius: IT Infrastructure Engineer

    £30000 - £40000 per annum: Recruitment Genius: Our client is looking to find a...

    Recruitment Genius: IT Engineer

    £21000 - £23600 per annum: Recruitment Genius: An exciting opportunity to join...

    Day In a Page

    Election 2015: How many of the Government's coalition agreement promises have been kept?

    Promises, promises

    But how many coalition agreement pledges have been kept?
    The Gaza fisherman who built his own reef - and was shot dead there by an Israeli gunboat

    The death of a Gaza fisherman

    He built his own reef, and was fatally shot there by an Israeli gunboat
    Saudi Arabia's airstrikes in Yemen are fuelling the Gulf's fire

    Saudi airstrikes are fuelling the Gulf's fire

    Arab intervention in Yemen risks entrenching Sunni-Shia divide and handing a victory to Isis, says Patrick Cockburn
    Zayn Malik's departure from One Direction shows the perils of fame in the age of social media

    The only direction Zayn could go

    We wince at the anguish of One Direction's fans, but Malik's departure shows the perils of fame in the age of social media
    Young Magician of the Year 2015: Meet the schoolgirl from Newcastle who has her heart set on being the competition's first female winner

    Spells like teen spirit

    A 16-year-old from Newcastle has set her heart on being the first female to win Young Magician of the Year. Jonathan Owen meets her
    Jonathan Anderson: If fashion is a cycle, this young man knows just how to ride it

    If fashion is a cycle, this young man knows just how to ride it

    British designer Jonathan Anderson is putting his stamp on venerable house Loewe
    Number plates scheme could provide a licence to offend in the land of the free

    Licence to offend in the land of the free

    Cash-strapped states have hit on a way of making money out of drivers that may be in collision with the First Amendment, says Rupert Cornwell
    From farm to fork: Meet the Cornish fishermen, vegetable-growers and butchers causing a stir in London's top restaurants

    From farm to fork in Cornwall

    One man is bringing together Cornwall's most accomplished growers, fishermen and butchers with London's best chefs to put the finest, freshest produce on the plates of some of the country’s best restaurants
    Robert Parker interview: The world's top wine critic on tasting 10,000 bottles a year, absurd drinking notes and New World wannabes

    Robert Parker interview

    The world's top wine critic on tasting 10,000 bottles a year, absurd drinking notes and New World wannabes
    Don't believe the stereotype - or should you?

    Don't believe the stereotype - or should you?

    We exaggerate regional traits and turn them into jokes - and those on the receiving end are in on it too, says DJ Taylor
    How to make your own Easter egg: Willie Harcourt-Cooze shares his chocolate recipes

    How to make your own Easter egg

    Willie Harcourt-Cooze talks about his love affair with 'cacao' - and creates an Easter egg especially for The Independent on Sunday
    Bill Granger recipes: Our chef declares barbecue season open with his twist on a tradtional Easter Sunday lamb lunch

    Bill Granger's twist on Easter Sunday lunch

    Next weekend, our chef plans to return to his Aussie roots by firing up the barbecue
    Joe Marler: 'It's the way I think the game should be played'

    Joe Marler: 'It's the way I think the game should be played'

    The England prop relives the highs and lows of last Saturday's remarkable afternoon of Six Nations rugby
    Cricket World Cup 2015: Has the success of the tournament spelt the end for Test matches?

    Cricket World Cup 2015

    Has the success of the tournament spelt the end for Test matches?
    The Last Word: Justin Gatlin knows the price of everything, the value of nothing

    Michael Calvin's Last Word

    Justin Gatlin knows the price of everything, the value of nothing