Target's mobile wish-list app exposed sensitive personal data, using an API that lacked authentication
Dan Goodin / Ars Technica :
Context & Ripple Effects
Target's disclosure lands mid-way through a 2015 run of mobile-security findings that keep surfacing the same failure mode: consumer-facing apps built on backends nobody locked down. Weeks earlier, researchers found tens of thousands of apps relying on default token security on cloud services like AWS, and Ars had already flagged apps from Walmart, CNN, ESPN and Slack with 300M combined downloads leaving accounts open to brute-force login attempts.
What makes the Target case distinct is that the leak ran through an API with no authentication at all — not a weak credential but an absent one — meaning anyone who found the endpoint could pull sensitive personal data directly. It foreshadows the pattern later seen when a [[a:929935|T-Mobile staff-site API bug let anyone fetch customer addresses and account PINs with just a phone number]].
First-order effects
- Target's wish-list app users have sensitive personal data reachable by anyone who queries the unauthenticated endpoint, and Target must shut down or lock the API while assessing what was accessed.
Second-order effects
- Retail peers named in adjacent findings — Walmart among them — face researcher scrutiny of their own mobile backends, since the same 2015 reporting already implicated their apps in account-takeover risk.
Third-order effects
- If the pattern holds across these disclosures, API authentication stops being an implementation detail and becomes a baseline audit item for retailers' mobile stacks — with unauthenticated endpoints treated as reportable defects rather than coding oversights.
The trend: Mobile app security failures are migrating from client-side weaknesses to unauthenticated backend APIs, pushing retailers to audit server-side endpoints as the primary exposure surface.