Marriott International 6.5.0 (iOS / App Store)

175x175bb (97)

This application is available for iOS. This app is designed to make booking hotels and travel accommodations with over 4,000 hotels and resorts in over 78 countries that you can quickly find accommodations and make reservations across any of Marriott’s 19 hotel brands. The latest build was released on Jul 07, 2017. Our latest check was performed on Mar 26th, 2017.

Findings Summary

Our examination revealed total 42 items, where were 5 DAR items and 37 DIT items found. Among DAR items were found 0 worst items, 3 bad items, 2 good items, and 0 best items. Among DIT items were found 3 worst items, 30 bad items, 2 good items, and 1 best item.

Below you find 4 infographics summarizing what we described above. Each image provides information about both DAR and DIT items.

 

 

This slideshow requires JavaScript.


Everything presented below is related to well-known CWEs, such as Sensitive data leakage [CWE-200], Unsafe sensitive data storage [CWE-312], Unsafe sensitive data transmission [CWE-319]. You can read more about it here.

Now let’s go deeper and examine each data item’s protection level.

 

Application Description

Let’s cite the description of this application below:

The Perfect Travel Companion™
Designed and developed for Marriott Rewards® members, the Marriott Mobile App makes managing your Marriott Rewards account and all your reservations, stays, and booking with Marriott® easier than ever.
With 4,400+ hotels and resorts from 18 brands in over 87 countries, there’s a hotel option available for all your travels, and the Marriott Mobile App provides exclusive benefits for Marriott Rewards members to make your stay better, including Mobile Check-In with Room Ready Alerts (including priority upgrades); Mobile Requests & Chat with the front desk for everything from an extra pillow to luggage assistance; Mobile Key, which allows you to go straight to your room at select locations; and Mobile Checkout with late checkout requests from anywhere – all from your preferred mobile device. Visit mobileapp.marriott.com for more details.

WORKS ON APPLE

  • iPhone, iPad, Apple Watch
  • Apple Wallet: Add confirmed reservations and your Rewards membership card.
  • TouchID on iPhone and iPad for simpler sign-in.
  • Apple Maps: Seamless use of native maps to improve searches and directions to or from hotels.
  • Available in English, Spanish, German, French, and Chinese.

MORE BENEFITS WITH MARRIOTT REWARDS

  • Easy enrollment: Sign up for Marriott Rewards directly in the app.
  • Member Rates: Lowest rate guaranteed for Marriott Rewards members.
  • Account Activity: Anywhere access to account balance, nights, points, and activity history.
  • Together with your SPG® Account: View your SPG account between the SPG and Marriott apps. In addition, transfer points between SPG and Marriott Rewards from the app.

RESERVATIONS MADE HANDY

  • Upcoming Reservations: View and manage all your reservations, including adding them to Apple Wallet and your calendar, and save hotels for easier reference to re-book.
  • Hotel Directions: Apple Maps–incorporated for smoother travel to and from the hotel.
  • Hotel Contact Info: One-touch calling and mobile chat with hotels – no more scrambling for phone numbers.
  • Active Stay: When you travel, your upcoming reservation becomes your homepage so you can readily access reservation information and Guest Services during your stay.

MORE CONVENIENT STAYS

  • Mobile Check-In: Get priority room assignments and Room Ready Alerts before you arrive.
  • Elite Benefits: Get priority upgrade assignments and confirmed priority late checkout.
  • Mobile Requests & Chat: Make requests anytime for towels, toiletries, and other common asks. When you need more help, chat with the front desk from the app, no need to call.
  • Mobile Key: At select hotels, go straight to your room and open the door with your iPhone or Apple Watch; it also works for the elevator, gym, parking garage, and other places a room key is needed.
  • Mobile Checkout: Expedite your departure and get your folio without needing to stop by the front desk.

EASIER BOOKING

  • Book our lowest rates, including rates exclusive to Marriott Rewards members.
  • Search using your nearby location, address or point of interest
  • Browse hotel photos, maps, city guides and amenities before booking or simply call a hotel (if supported by your device).
  • Save and manage hotels at which you regularly stay so rebooking at the same hotel is faster and easier
  • Get inspired with ideas for where to go and what to do at your favorite destinations with articles from Marriott TRAVELER.

READY TO GO?
Download our app and book a trip at one of Marriott’s 18 brands including The Ritz-Carlton®, EDITION®, JW Marriott®, Autograph Collection® Hotels, Renaissance® Hotels, Marriott Hotels®, Delta Hotels®, Marriott Executive Apartments®, Marriott Vacation Club®, Gaylord Hotels®, AC Hotels® by Marriott, Courtyard®, Residence Inn®, SpringHill Suites®, Fairfield Inn & Suites®, TownePlace Suites®, Protea Hotels®, and Moxy® Hotels.

 

Protection levels.

Locally stored data (Data-at-Rest, DAR).

Locally stored data groups include Media Information, Booking ‘n’ Purchases Information, Device Information, Credentials Information.
The average DAR value is 4.60 points (7.00 points of system protection and 2.20 points of own protection). It is higher than a typical value (3.5 points, where’s 7 points of system protection and 0 points of own protection).

Items’ GROUP #1 with average value 6.50 points (7 points of system protection, 6 points of own protection) means data protection levels have following definitions. Frankly talking, protection and privacy issues are still possible but might involve interaction with an app code where system protection level means – root/jailbreak is required but not possible without wiping device data, and own protection level means – data is not available in backups.

– Screen Snapshots (‘Media Information’ Group) – Screenshots of your device screen running certain apps; common as an iOS app multitasking feature (app swipes) or browser tab swipes. This data item related to mentioned group meant to be any data like photo, image, video, audio

Items’ GROUP #2 with average value 6.00 points (7 points of system protection, 5 points of own protection) means data protection levels have following definitions. Frankly talking, protection and privacy issues are still possible but might involve interaction with an app code where system protection level means – root/jailbreak is required but not possible without wiping device data, and own protection level means – wiping/not storing most of time/storing up-to-date info (last 30-180 days) locally only.

– Orders & Reservation History (‘Booking ‘n’ Purchases Information’ Group) – Basic info about orders, reservations, like ID, date and time, amount of payment, and place (depends on apps). This data item related to mentioned group meant to be any info related to your booking and purchases like travel, app or another kind of purchases

Items’ GROUP #3 with average value 3.50 points (7 points of system protection, 0 points of own protection) means data protection levels have following definitions. Frankly talking, extra data found that shouldn’t be accessed where system protection level means – root/jailbreak is required but not possible without wiping device data, and own protection level means – stored as is.

– Device Data (‘Device Information’ Group) – Device ID, Device Name, Device OS Name and Version, and jailbroken/root status. This data item related to mentioned group meant to be details about your device,

– Credentials (IDs) (‘Credentials Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.,

– Credentials (Tokens) (‘Credentials Information’ Group) – Different tokens used to get access to your account, except for passwords but including app or 3rd party tokens, secret keys, etc. (usually give full access to your account). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.

Also, keep in mind, using jailbroken device means the system protection level is 0 points and you’re using out-of-date iOS < 8.3 the system protection level is 2 points. If some data marked as shareable via iTunes, then the system protection level is 4 points.

Transferred data (Data-in-Transit, DIT).

Transferred data groups include Device Information, Travel Information, Location ‘n’ Maps Information, Credentials Information, Personal ‘n’ Private Information, Account Information, Loyalty Information, Media Information, Analytics ‘n’ Ads Information, Booking ‘n’ Purchases Information, Payment ‘n’ Transaction Information, Financial Information, Browser Information.
The average DIT value is 4.16 points (4.59 points of system protection and 3.73 points of own protection). It is higher than a typical value (4 points, where’s 4 points of system protection and 4 points of own protection).

Items’ GROUP #1 with average value 4.50 points (5 points of system protection, 4 points of own protection) means data protection levels have following definitions. Frankly talking, data available if it’s allowed only and may require user action where system protection level means – some techniques are available to developers to keep connection bypassing system settings, like proxy settings, etc., and own protection level means – bypassed by fake/stolen root certificates.

– Environment (‘Device Information’ Group) – Different info about the environment of the device including apps lists, device info, OS name and versions, updates, a list of users, network details, etc. This data item related to mentioned group meant to be details about your device,

– Tracked Data ‘n’ Favorites (‘Travel Information’ Group) – Any favorites data or tracked data marked as desirable by users and for users (Means, user is on FB messenger, Viber, bank client or favourite hotel, room type, flight route, airline). This data item related to mentioned group meant to be any travel info like flight, accommodation, ground transportation, etc.,

– Tracked Data ‘n’ Favorites (‘Location ‘n’ Maps Information’ Group) – Any favorites data or tracked data marked as desirable by users and for users (Means, user is on FB messenger, Viber, bank client or favourite hotel, room type, flight route, airline). This data item related to mentioned group meant to be any geodata from trackers, social networks, GPS, etc.,

– Credentials (IDs) (‘Credentials Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.,

– Credentials (Passwords) (‘Credentials Information’ Group) – Well-known passwords or PINs you’re using to get access to your account (usually it is worse than tokens because it gives full access to your account). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.,

– Credentials (Tokens) (‘Credentials Information’ Group) – Different tokens used to get access to your account, except for passwords but including app or 3rd party tokens, secret keys, etc. (usually give full access to your account). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.,

– Personalization (‘Personal ‘n’ Private Information’ Group) – Info describes user preferences, favorites, tracked data, search requests, suggestions, etc. This data item related to mentioned group meant to be any personal and private info is not grabbed from the 3rd party social networks or your IDs,

– Tracked Data ‘n’ Favorites (‘Personal ‘n’ Private Information’ Group) – Any favorites data or tracked data marked as desirable by users and for users (Means, user is on FB messenger, Viber, bank client or favourite hotel, room type, flight route, airline). This data item related to mentioned group meant to be any personal and private info is not grabbed from the 3rd party social networks or your IDs,

– Account Details (‘Account Information’ Group) – Full info about your account including account membership, expiration, profile, linked data and account, etc. This data item related to mentioned group meant to be any info related to profiles, basic credential IDs like email or username or phone number plus some more info depends on applications,

– Address Data (‘Account Information’ Group) – Home, work or another type of owner address stored by apps. This data item related to mentioned group meant to be any info related to profiles, basic credential IDs like email or username or phone number plus some more info depends on applications,

– Credentials (IDs) (‘Loyalty Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc.,

– Credentials (Passwords) (‘Loyalty Information’ Group) – Well-known passwords or PINs you’re using to get access to your account (usually it is worse than tokens because it gives full access to your account). This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc.,

– Account Details (‘Loyalty Information’ Group) – Full info about your account including account membership, expiration, profile, linked data and account, etc. This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc.,

– Device Data (‘Analytics ‘n’ Ads Information’ Group) – Device ID, Device Name, Device OS Name and Version, and jailbroken/root status. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,

– Network Data (‘Analytics ‘n’ Ads Information’ Group) – Basic info about network used to make a connection, such as a device like IP, connection type. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,

– Orders & Reservation Details (‘Booking ‘n’ Purchases Information’ Group) – Full info about orders, reservations, like ID, date and time, amount of payment, flight routes, hotel or another order details, rules, linked data. This data item related to mentioned group meant to be any info related to your booking and purchases like travel, app or another kind of purchases,

– Address Data (‘Travel Information’ Group) – Home, work or another type of owner address stored by apps. This data item related to mentioned group meant to be any travel info like flight, accommodation, ground transportation, etc.,

– GEO Data (‘Travel Information’ Group) – Any GEO info stored as plain text referred to the places or tracked activity. This data item related to mentioned group meant to be any travel info like flight, accommodation, ground transportation, etc.,

– Media Data (‘Travel Information’ Group) – Any info like images, audios, videos, media notes, etc. This data item related to mentioned group meant to be any travel info like flight, accommodation, ground transportation, etc.,

– Travel Details (‘Travel Information’ Group) – Full info about accommodation (hotel, address, contacts, room, date and time, facilities, media data), flights (routes, location, date and time, media data) or ground (routes, location, date and time, media data). This data item related to mentioned group meant to be any travel info like flight, accommodation, ground transportation, etc.,

– Card Short Information (‘Payment ‘n’ Transaction Information’ Group) – Some info about card holder, card number full or short) and expiration. This data item related to mentioned group meant to be details about transactions and payment data involved into transaction records,

– Card Short Information (‘Financial Information’ Group) – Some info about card holder, card number full or short) and expiration. This data item related to mentioned group meant to be any info that describe payments capabilities,

– Card Verification Code (‘Payment ‘n’ Transaction Information’ Group) – CVC, CVV stored separately from rest card info. This data item related to mentioned group meant to be details about transactions and payment data involved into transaction records,

– Credentials (IDs) (‘Browser Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app,

– Credentials (Passwords) (‘Browser Information’ Group) – Well-known passwords or PINs you’re using to get access to your account (usually it is worse than tokens because it gives full access to your account). This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app,

– Personalization (‘Browser Information’ Group) – Info describes user preferences, favorites, tracked data, search requests, suggestions, etc. This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app,

– Tracked Data ‘n’ Favorites (‘Browser Information’ Group) – Any favorites data or tracked data marked as desirable by users and for users (Means, user is on FB messenger, Viber, bank client or favourite hotel, room type, flight route, airline). This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app,

– Travel Details (‘Browser Information’ Group) – Full info about accommodation (hotel, address, contacts, room, date and time, facilities, media data), flights (routes, location, date and time, media data) or ground (routes, location, date and time, media data). This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app,

– Orders & Reservation Details (‘Browser Information’ Group) – Full info about orders, reservations, like ID, date and time, amount of payment, flight routes, hotel or another order details, rules, linked data. This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app,

– Card Short Information (‘Browser Information’ Group) – Some info about card holder, card number full or short) and expiration. This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app,

– Card Verification Code (‘Browser Information’ Group) – CVC, CVV stored separately from rest card info. This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app

Items’ GROUP #2 with average value 0.00 points (0 points of system protection, 0 points of own protection) means data protection levels have following definitions. Frankly talking, data ‘as is’ and easily accessed (plaintext, no protection at all) where system protection level means – transferred (or supposed to be) ‘as is’ (plaintext) due to jailbreak/root or preinstalled non-trusted firmware, certificates, etc., and own protection level means – transferred as is, perhaps protection mode turns off or doesn’t exist or info reveal eventually.

– Tracked Data ‘n’ Favorites (‘Media Information’ Group) – Any favorites data or tracked data marked as desirable by users and for users (Means, user is on FB messenger, Viber, bank client or favourite hotel, room type, flight route, airline). This data item related to mentioned group meant to be any data like photo, image, video, audio,

– Environment (‘Analytics ‘n’ Ads Information’ Group) – Different info about the environment of the device including apps lists, device info, OS name and versions, updates, a list of users, network details, etc. This data item related to mentioned group meant to be any info related to analytics services like Flurry, Google Analytics, etc. or advertisements,

– Maps Data (‘Location ‘n’ Maps Information’ Group) – Map data loaded by internal (native) or third party map applications like Apple/Google Maps or another one. This data item related to mentioned group meant to be any geodata from trackers, social networks, GPS, etc.

Items’ GROUP #3 with average value 5.00 points (5 points of system protection, 5 points of own protection) means data protection levels have following definitions. Frankly talking, data is not available all the time or partially accessed where system protection level means – some techniques are available to developers to keep connection bypassing system settings, like proxy settings, etc., and own protection level means – server-side limitations (SSL validation/pinning, limited access to outdated records) and client-side limitations (pinning with user-decision behavior, additionally ecnrypted/hashed data item, or own cert storage).

– Orders & Reservation History (‘Booking ‘n’ Purchases Information’ Group) – Basic info about orders, reservations, like ID, date and time, amount of payment, and place (depends on apps). This data item related to mentioned group meant to be any info related to your booking and purchases like travel, app or another kind of purchases,

– Orders & Reservation History (‘Browser Information’ Group) – Basic info about orders, reservations, like ID, date and time, amount of payment, and place (depends on apps). This data item related to mentioned group meant to be any info browser stores (credentials, history, cached documents, media, etc.) and activities made via browser instead of native app

Keep in mind if you’re using out-of-date iOS < 9.0, the system level equals 2 points instead of 4. It means your data can be stolen without involving your actions.

Privacy Policy

Full application privacy policy is available here.

You may find privacy policy details proceeding the link above to compare developer’s vision on data protection with our results.