Issue 219: Money Lover app exposes user data, most web API flaws missed by standard testing

This week, we have news of a recent vulnerability in the Money Lover finance app, and a report into a recent vulnerability in Toyota vehicles, which, according to Toyota, did not result in malicious access.

We have an article featuring the views of popular contributor Corey Ball on missing API flaws by using conventional testing and, finally, an update on Twitter’s ongoing efforts to thwart the rise of bots on their platform.

Vulnerability: Money Lover app exposes user data

First up this week is coverage from Dark Reading on a potential vulnerability in the “Money Lover” app developed by Vietnam-based Finsify. The app is a tool for managing personal finances and has a 4. 6-star rating from over 1,000 reviewers. According to researchers at Trustwave, the app leaked no actual bank account or credit card details but warned that the financial institution could suffer a reputation hit.