This application is available for iOS. >>>> SHORT DESCRIPTION <<<<<. The latest build was released on Mar 29, 2017. Our latest check was performed on Mar 26th, 2017.
Findings Summary
Our examination revealed total 27 items, where were 14 DAR items and 13 DIT items found. Among DAR items were found 0 worst items, 8 bad items, 6 good items, and 0 best items. Among DIT items were found 0 worst items, 13 bad items, 0 good items, and 0 best items.
Below you find 2 infographics summarizing what we described above. Each image provides information about both DAR and DIT items.
Everything presented below is related to well-known CWEs, such as Sensitive data leakage [CWE-200], Unsafe sensitive data storage [CWE-312], Unsafe sensitive data transmission [CWE-319]. You can read more about it here.
Now let’s go deeper and examine each data item’s protection level.
Application Description
Let’s cite the description of this application below:
Aviakassa is a free app from the team of Aviakassa.ru, an online service for purchase of air tickets, which is now available on iPhone. The service joins 834 airlines and 5 booking systems (GDS) to help us search better prices of air tickets and offer a wide range of flight options.
Our achievements:
***First week in the App Store Russia and 1 place in the section “News of the week” on the home page***
***Fourth week in the App Store Russia and 2nd place in the collection of the “vacation Planning” category “Travel”***
***The first month in the App Store Russia and 3rd place in the “Best for April” on the home page***
In the app you can find:
- Search of air tickets
- Chat with 24/7 support
- Use of airlines bonus cards
- Personal account
- Booking of air tickets and payment with banking cards right in the application
- Selection of flight time options before search
- Entry of your data as well as data of your family and friends in your account for booking and purchase of air tickets in one click
- List of orders
- Rate your flight
- Auto-fill of passenger data at the stage of issue of air tickets
- Electronic ticket (Itinerary) sent by email
- Passenger Guide
- Search results in which every person can find a ticket (Low cost airlines, Charters, Without transfers, 1 transfer, etc.)
- Minimum filters and maximum convenience for search of air tickets
- Tickets sorted by price and airline (which will definitely save time for you)
- Other useful functions will be added in near future
We wish you pleasant flights and best prices.
We are always happy to see you among our new and permanent users.
We appreciate your comments and rates in the App Store. If you want to get in touch with us, please write to mobile@aviakassa.ru.
Protection levels.
Locally stored data (Data-at-Rest, DAR).
Locally stored data groups include Visa ‘n’ Passport Information, Credentials Information, Payment ‘n’ Transaction Information, Loyalty Information, Analytics ‘n’ Ads Information, Media Information, Personal ‘n’ Private Information, Log Information.
The average DAR value is 4.79 points (7.00 points of system protection and 2.57 points of own protection). It is higher than a typical value (3.5 points, where’s 7 points of system protection and 0 points of own protection).
Items’ GROUP #1 with average value 3.50 points (7 points of system protection, 0 points of own protection) means data protection levels have following definitions. Frankly talking, extra data found that shouldn’t be accessed where system protection level means – root/jailbreak is required but not possible without wiping device data, and own protection level means – stored as is.
– Passport Details (‘Visa ‘n’ Passport Information’ Group) – Full info including name, number expiration, address, gender, birthday, country, family, etc., except biometric data. This data item related to mentioned group meant to be all details are part of passport, visa or another ids,
– Credentials (IDs) (‘Credentials Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.,
– Credentials (IDs) (‘Loyalty Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc.,
– Device Data (‘Analytics ‘n’ Ads Information’ Group) – Device ID, Device Name, Device OS Name and Version, and jailbroken/root status. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,
– Credentials (Access IDs) (‘Analytics ‘n’ Ads Information’ Group) – Different tokens used to get access to your account, except for passwords but including app or 3rd party tokens, secret keys, etc. (usually don’t give full access to your account because based on permissions linked to these access tokens). This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,
– Personalization (‘Analytics ‘n’ Ads Information’ Group) – Info describes user preferences, favorites, tracked data, search requests, suggestions, etc. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,
– Personalization (‘Personal ‘n’ Private Information’ Group) – Info describes user preferences, favorites, tracked data, search requests, suggestions, etc. This data item related to mentioned group meant to be any personal and private info is not grabbed from the 3rd party social networks or your IDs,
– GEO Data (‘Personal ‘n’ Private Information’ Group) – Any GEO info stored as plain text referred to the places or tracked activity. This data item related to mentioned group meant to be any personal and private info is not grabbed from the 3rd party social networks or your IDs
Items’ GROUP #2 with average value 6.50 points (7 points of system protection, 6 points of own protection) means data protection levels have following definitions. Frankly talking, protection and privacy issues are still possible but might involve interaction with an app code where system protection level means – root/jailbreak is required but not possible without wiping device data, and own protection level means – data is not available in backups.
– Card Full Information (‘Payment ‘n’ Transaction Information’ Group) – All details about card include short info, holder address, bank info and CVC, CVV, CVV2. This data item related to mentioned group meant to be details about transactions and payment data involved into transaction records,
– Screen Snapshots (‘Media Information’ Group) – Screenshots of your device screen running certain apps; common as an iOS app multitasking feature (app swipes) or browser tab swipes. This data item related to mentioned group meant to be any data like photo, image, video, audio,
– Application Configs (‘Analytics ‘n’ Ads Information’ Group) – Different configuration files created by your app, perhaps app permissions. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,
– Log Data (‘Log Information’ Group) – Logged any data as a solid file or multipart files. This data item related to mentioned group meant to be any information stored in local or network logs,
– Device Data (‘Log Information’ Group) – Device ID, Device Name, Device OS Name and Version, and jailbroken/root status. This data item related to mentioned group meant to be any information stored in local or network logs,
– Environment (‘Log Information’ Group) – Different info about the environment of the device including apps lists, device info, OS name and versions, updates, a list of users, network details, etc. This data item related to mentioned group meant to be any information stored in local or network logs
Also, keep in mind, using jailbroken device means the system protection level is 0 points and you’re using out-of-date iOS < 8.3 the system protection level is 2 points. If some data marked as shareable via iTunes, then the system protection level is 4 points.
Transferred data (Data-in-Transit, DIT).
Transferred data groups include Travel Information, Visa ‘n’ Passport Information, Booking ‘n’ Purchases Information, Credentials Information, Payment ‘n’ Transaction Information, Loyalty Information, Analytics ‘n’ Ads Information.
The average DIT value is 4.50 points (5.00 points of system protection and 4.00 points of own protection). It is higher than a typical value (4 points, where’s 4 points of system protection and 4 points of own protection).
Items with average value 4.50 points (5 points of system protection, 4 points of own protection) means data protection levels have following definitions. Frankly talking, data available if it’s allowed only and may require user action where system protection level means – some techniques are available to developers to keep connection bypassing system settings, like proxy settings, etc., and own protection level means – bypassed by fake/stolen root certificates.
– Travel Details (‘Travel Information’ Group) – Full info about accommodation (hotel, address, contacts, room, date and time, facilities, media data), flights (routes, location, date and time, media data) or ground (routes, location, date and time, media data). This data item related to mentioned group meant to be any travel info like flight, accommodation, ground transportation, etc.,
– Passport Details (‘Visa ‘n’ Passport Information’ Group) – Full info including name, number expiration, address, gender, birthday, country, family, etc., except biometric data. This data item related to mentioned group meant to be all details are part of passport, visa or another ids,
– Orders & Reservation Details (‘Booking ‘n’ Purchases Information’ Group) – Full info about orders, reservations, like ID, date and time, amount of payment, flight routes, hotel or another order details, rules, linked data. This data item related to mentioned group meant to be any info related to your booking and purchases like travel, app or another kind of purchases,
– Orders & Reservation History (‘Booking ‘n’ Purchases Information’ Group) – Basic info about orders, reservations, like ID, date and time, amount of payment, and place (depends on apps). This data item related to mentioned group meant to be any info related to your booking and purchases like travel, app or another kind of purchases,
– Credentials (IDs) (‘Credentials Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.,
– Credentials (Passwords) (‘Credentials Information’ Group) – Well-known passwords or PINs you’re using to get access to your account (usually it is worse than tokens because it gives full access to your account). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.,
– Card Full Information (‘Payment ‘n’ Transaction Information’ Group) – All details about card include short info, holder address, bank info and CVC, CVV, CVV2. This data item related to mentioned group meant to be details about transactions and payment data involved into transaction records,
– Credentials (IDs) (‘Loyalty Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc.,
– Device Data (‘Analytics ‘n’ Ads Information’ Group) – Device ID, Device Name, Device OS Name and Version, and jailbroken/root status. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,
– Credentials (Access IDs) (‘Analytics ‘n’ Ads Information’ Group) – Different tokens used to get access to your account, except for passwords but including app or 3rd party tokens, secret keys, etc. (usually don’t give full access to your account because based on permissions linked to these access tokens). This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,
– Device Details (‘Analytics ‘n’ Ads Information’ Group) – Includes basic device details plus hardware key and fingerprints as well as IMEI. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,
– Passport Details (‘Booking ‘n’ Purchases Information’ Group) – Full info including name, number expiration, address, gender, birthday, country, family, etc., except biometric data. This data item related to mentioned group meant to be any info related to your booking and purchases like travel, app or another kind of purchases,
– Log Data (‘Analytics ‘n’ Ads Information’ Group) – Logged any data as a solid file or multipart files. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements
Keep in mind if you’re using out-of-date iOS < 9.0, the system level equals 2 points instead of 4. It means your data can be stolen without involving your actions.
Privacy Policy
No Privacy Policy is available for this application.
PrivacyMeter 