mobile_threat_blog_icon

Mobile Threat Blog

  • Mobile
    Security Insights
  • Mobile
    Threat Research
  • Mobile
    Security Tips
Appthority EMTR QA
Share

Apple announced at its 2016 WWDC that all iOS apps will be required to follow and use App Transport Security (ATS) by January 2017. Appthority described the current status of apps meeting this requirement and challenges associated with ATS in its Q4 Mobile Threat Report entitled ATS: Enterprise Impacts of Apple’s New Encryption Requirements. In this post, we provide some of the underlying technical detail behind our ATS analysis.

Download the report | ATS: Enterprise Impacts of Apple’s New Encryption Requirements

Our ATS analysis was performed on the top 200 iOS apps installed on enterprise devices worldwide (see list at the bottom of this post). We found that, surprisingly, only 3% of apps in our study implement ATS with no exceptions. That doesn’t mean that 97% of apps use no encryption; it’s more complicated than that. Below, we provide some of the technical detail behind the complications.

Enforcing App Transport Security

Here’s what Apple said about enforcing ATS in slides from their “What’s New in Security” presentation at the WWDC in July:  apple-ats-slide We’ll unpack the technical detail and rationale behind this move below.

Configuring ATS  

ATS covers several attributes of iOS app’s network security, including HTTPS, Transport Layer Security (TLS) versions, Perfect Forward Secrecy (PFS), and Certificate Transparency. The key “NSAppTransportSecurity” describes the app’s intended HTTP connection behaviors and contains the configuration and exceptions. ATS keys are defined in the table below: ats-keys-table2 To see how it works in practice, an example Info.plist with ATS exception is shown below. ats-exception-example Info.plist contains the ATS settings. In the example above, exceptions are defined for two different domains: media.example.com; and other.example.com. In the first case, encryption is not performed in the media domain. We’ll discuss below why that might be too broad of an exception; the “NSAllowsArbitraryLoadsInMedia” attribute provides that same exception but only for media files within the domain. In the second case, it is specified that PFS is not enabled, and the minimum-allowed Transport Layer Security (TLS) version is set to v1.1.

Enterprise Apps using ATS

In order to understand how ATS is being used now for apps in the enterprise we analyzed the top 200 iOS apps found on enterprise devices. Here are our findings: ats-ent-apps Among the top 200 iOS apps that we analyzed, 166 apps (83%) bypass at least some ATS requirements by setting “NSAllowsArbitraryLoads” attribute to “true” in their Info.plist files. However, not all of them bypass ATS requirements for all network connections. For instance, a company can still support ATS requirements for network connections with its domain, while allowing ATS to bypass all other connections. This is done by including “NSExceptionDomains” attributes. The domain names under this “NSExceptionDomains” attribute are fully protected, unless exceptions are added. We discovered that 78 apps (39%) added this attribute and customized their own security rules for specific network connections. It’s also interesting to note that 51 apps (26%) had ATS disabled at a global level and then set specific exceptions for domains. This is done when an app wants to use ATS only for its domain while adding exceptions for all other network connections. It’s also done when an app wants to use HTTPS only for what are deemed important connections. For instance, Microsoft OneDrive disables for most of the connections, except the 5 log-in connections to its server. The domains listed in the exception domain list are protected by ATS. As we explained in the Appthority Q4 Mobile Threat Research Article on ATS, changes from the ATS defaults (especially the NSAllowsArbitraryLoads settings) may trigger an App Store review and require “reasonable justification” during the application review process. This allows developers to appeal when use of HTTPS is infeasible or imposes a performance burden.

Effectiveness of ATS

We discovered that 115 of the top 200 enterprise apps (57%) do not use ATS at all by specifying “NSAllowsArbitraryLoads” to “true” and not specifying any “NSExceptionDomains”. This  seems to be a high number of apps not conforming to the security requirements and best practices. However, when we compared it with Android, iOS apps make much higher use of ATS.  Among the top 200 Android apps, 160 apps (80%) do not use HTTPS. iOS apps’ use of HTTPS is significantly higher than Android at this time–and is expected to improve even further as of January, 2017. Among the top 200 iOS apps in enterprises, apps not using 100% HTTPS include:

  • Social networking apps, such as Facebook, Twitter, and Linkedin
  • Messaging apps, such as Facebook messenger, Skype, Viber, and WhatsApp
  • News apps, such as Fox News, CNN, and BBC
  • Media-related apps, such as Netflix, ESPN, Hulu, Pandora, and Amazon Cloud Player
  • Microsoft products, such as Word, Excel, PowerPoint, and OneNote
  • Other apps, such as flashlight, QR code reader, and game apps

One might argue that some types of apps, such as news and flashlight apps, do not need to use HTTPS, since they do not transfer sensitive data. Thus, we performed a more in-depth analysis. We found that the following apps are disabling ATS requirements and sending sensitive data unencrypted. The unencrypted data includes Device ID, location and other sensitive information, such as email and even passwords. sens-data-unencrypted-apps Of the top 200 iOS enterprise apps we found 16 that set the TLS version manually by setting “NSExceptionMinimumTLSVersion” attribute. Most of the 16 apps set the TLS version lower, which uses older and weaker cyphers. The current default TLS version is 1.2: 6 apps set the TLS version to 1.0 and 2 of them set it to 1.1. Using lower TLS versions effectively downgraded the security of the apps. We also discovered 38 apps that disable Forward Secrecy by setting “false” to “NSExceptionRequiresForwardSecrecy” attribute in ATS. Forward secrecy ensures that any compromise of long-term keys does not compromise past session keys.

Why Developers Don’t Or Can’t Fully Embrace ATS

ATS enforcement does not impose problems for apps that only communicate with their own web servers. They may have to start paying for HTTPS connection support for their web servers, if not already present, but that’s rarely a big cost. But many apps depend on other web servers that are out of their control. For instance, one developer stated on the official Apple forum,

“I understand that security is important, but there are far too many services that still use HTTP. I have an app that pulls images from NOAA over an HTTP connection. I don’t see them switching to HTTPS anytime soon. Without an exception, my app would be useless.”

Another scenario is when apps include SDKs that still use HTTP connections. For instance, when ATS became available in 2015, iOS developers had to use ATS exceptions so that they could support the Google Mobile Ads SDK. Obviously, app developers face challenges over and above just enabling ATS on their app when they connect to servers they don’t control. Appthority’s analysis shows that the followings are the most common web services that received unencrypted traffic from apps with ATS disabled: Scorecardresearch, a global market research service; and Crashlytics, a crash reporting service. We also discovered that many media apps bypass ATS requirements. This is due to the bulk media files that they have to stream; encrypting them could impact performance and battery usage. However, we notice that these media apps are not using “NSAllowsArbitraryLoadsInMedia” attribute, which allows encryption exception only for media content. Instead, they are using “NSAllowsArbitraryLoads” attribute, which allows encryption exception for all the network connections. This is a potential cause for concern, because even the media apps, such as Netflix, transfer personal information, including login account information, which should be properly encrypted. Appthority recommends as a developer best practice for media apps to follow ATS requirements while transferring personal information, while using only the “NSAllowsArbitraryLoadsInMedia” attribute for transferring media data. As of January 2017, due to new App Store guidelines, using the “NSAllowsArbitraryLoads” attribute triggers review and requires justification for the exception by the developer. We would expect that this would encourage greater use of the “NSAllowsArbitraryLoadsInMedia” attribute, which allows encryption exception only for media content and therefore would require encryption of personal information. We should note that among the top 200 iOS apps, we do not find any apps, which are using  “NSAllowsArbitraryLoadsInMedia” and “NSAllowsArbitraryLoadsInWebContent” attributes.

Using ATS Doesn’t Mean An App Is Secure

Adding the ‘S’ to HTTP makes the connection secure, right? Not always. There are network security measures not covered by ATS that can make apps more secure. For instance, Certificate Transparency is not one of the mandatory requirements of ATS. Certificate transparency logs the certificates and monitors/audits them in a separate server. The default value of “NSRequiresCertificateTransparency” attribute is “False”. Developers have to manually set it to “True” to protect their apps with Certificate Transparency. Our analysis also shows that none of the 200 apps is using Certificate Transparency. SSL validation and pinning are good alternatives to certificate transparency. They validate the servers that apps are connecting to, and ensure that the end-to-end connection is secure. Therefore, we also analyzed them and found out that 7 apps disable SSL validation and 109 apps do not support certificate pinning for at least one connection. Among the top 200 iOS apps, we found 2 apps (1%) that have ATS on by default but disable SSL validation. We also found 46 apps (23%) that have ATS on by default but are not using SSL pinning. Despite the fact they have ATS enabled, without certificate validation or pinning they are vulnerable to Man-in-The-Middle (MiTM) attacks. Out of 166 apps (83%) which disable ATS features by setting “NSAllowsArbitraryLoads” to “true”, 77 apps (33.5%) use SSL pinning for at least one connection and 2 apps (1%) use SSL pinning for all connections. These apps have taken strong security measures, even though they do not use certificate transparency. Moreover, there is still room for improvement in the certificate transparency feature of ATS. Apple states: “Enabling Certificate Transparency does not eliminate the need for your app to revoke invalid certificates and to refuse connections that employ them.” It just makes MITM attacks more difficult.

ATS and App Risk in 2017

January 1, 2017 is the date when Apple will start enforcing ATS for any apps being submitted to the App Store. Due to the dependency and usability issues noted above, Apple is allowing exceptions to ATS as long as the developers provide good justifications. Thus, we still expect iOS apps with unencrypted data in enterprise environments, even after January 1. When Apple approves such apps for the App Store, there will still be the security risks associated with unencrypted data for some connections, so it’s important for enterprises to have visibility into and management of the risks related to apps with those exceptions. It’s too early to say what percentage of apps will ask for — and be granted — exceptions. But Appthority customers can detect the apps with exceptions by finding Threat Indicators where “Does not enforce HTTPS connections” is true, and manage them as risky apps. We applaud Apple’s decision to enforce use of ATS on iOS apps. But we know that ATS, while a good start, is not enough. For example, two iOS banking apps we analyzed show that, although they incorporate SSL protocols for connections, their implementation is weakened by disabling the certificate check on their servers. This makes their apps vulnerable to Man-In-The-Middle (MiTM) attackers impersonating legitimate servers and exfiltrating corporate data. Appthority users can detect apps vulnerable to MiTM attacks where “All SSL connections are using Certificate Pinning” is False, and remediate accordingly. While we recommend developers follow the ATS guidelines from Apple and implement their security protocols, ATS is only one part of the security picture, albeit a very important one, in making apps more secure.

What To Do Now

Here are four things you can do now to enhance your enterprise’s security profile by implementing the ATS feature and maximizing its use in your enterprise.

  1. Implement a mobile security tool that makes app encryption settings visible
  2. Establish and enforce security policies that include app encryption best practices
  3. Ensure that your apps use certificate pinning, the strongest means available to prevent man-in-the-middle (MiTM) attacks
  4. Review any apps your enterprise develops to ensure they are using the ATS feature with no exceptions or as few as possible

Get the report | ATS: Enterprise Impacts of Apple’s New Encryption Requirements


Connections for Top 200 Apps

# of Apps URL Connected to
179 www.apple.com
162 itunes.apple.com
116 www.google.com
109 www.w3.org
94 facebook.com
84 www.googleapis.com
79 www.facebook.com
79 developers.facebook.com
74 logo.verisign.com
74 com.alamofire.net
73 www.digicert.com
73 com.apple.mobi
73 0www.entrust.net
71 settings.crashlytics.com
69 api.crashlytics.com
68 maps.google.com
66 reports.crashlytics.com
66 com.crashlytics.de
63 maps.apple.com
63 com.alamofire.networking.reachability.ch
59 google.com
58 www.googleadservices.com
58 doubleclick.net
57 googleads.g.doubleclick.net
56 e.admob.com
56 com.google.admob.net
56 com.google.admob.de
56 badad.googleplex.com
56 adx.g.doubleclick.net
55 graph.facebook.com
54 com.google.admob.ch
52 group.com
51 csi.gstatic.com
48 pagead2.googlesyndication.com
47 com.com
46 base.de
45 twitter.com
45 phobos.apple.com
45 api.twitter.com
42 embedded.mobi
40 www.google-analytics.com
40 ssl.google-analytics.com
40 accounts.google.com
39 www.openssl.org
39 p.ch
38 com.alamofire.networking.task.com
38 com.alamofire.networking.com
38 b.scorecardresearch.com
37 udm.scorecardresearch.com
37 sb.scorecardresearch.com
36 rink.hockeyapp.net
36 com.apple.root.de
35 www.youtube.com
35 play.googleapis.com
34 sdk.hockeyapp.net
33 fbcdn.net
33 akamaihd.net
33 a.de
31 oauth.net
31 example.com
30 self.de
30 maps.googleapis.com
29 src.de
29 src.ch
29 pubads.g.doubleclick.net
29 mask.de
29 e.a.ch
29 delta.ch
28 tt.omtrdc.net
28 ax.itunes.apple.com
28 a.media.ch
27 www.googletagmanager.com
27 itunes.com
27 com.google.ch
27 bject.de
26 schemas.xmlsoap.org
26 kernel.ch
26 com.google.preferences.ch
26 com.adobe.mobi
26 a.media.mil
26 a.media.com
26 a.media.ad.mil
26 a.media.ad.com
25 s3.amazonaws.com
25 dpm.demdex.net
24 m.ch
23 rt.ru
23 github.com
22 yahoo.com
22 support.google.com
22 ndex.info
22 data.flurry.com
22 battery.ch
22 appcloud.flurry.com
22 appcloud-node-stage.corp.flurry.com
22 ads.flurry.com
22 adlog.flurry.com
21 www.twitter.com
21 www.gstatic.com
21 stream.cc

The Top 200 iOS Apps Installed on Enterprise Devices Worldwide

Category

App Label

App Name

Books

Audible – audio books,original series & podcasts

com.audible.iphone

Books

Kindle – Read eBooks, Magazines & Textbooks

com.amazon.Lassen

Books

OverDrive – Library eBooks and Audiobooks

com.overdrive.odm

Business

Adobe Acrobat Reader – View, Annotate & Share PDFs

com.adobe.Adobe-Reader

Business

Box for iPhone and iPad

net.box.BoxNet

Business

Cisco WebEx Meetings

com.webex.meeting

Business

Citrix Receiver

com.citrix.ReceiveriPad

Business

Concur – Travel, Receipts, Expense Reports

com.concur.concurmobile

Business

Genius Scan – PDF Scanner

com.geniussoftware.GeniusScan

Business

GoToMeeting

com.citrixonline.iOS.GoToMeeting

Business

IBM Notes Traveler Companion

com.ibm.lotus.travelercompanion

Business

Parkmobile – Paid parking made easy with free mobile app

us.parkmobile.ParkMobile

Business

RSA SecurID Software Token

com.rsa.securid.iphone.SecurID

Business

Skype for Business (formerly Lync 2013)

com.microsoft.lync2013.iphone

Business

Tiny Scanner – PDF scanner to scan document, receipt & fax

com.btgs.scannerhdlite

Business

TurboScan™ Pro – document & receipt scanner: scan multiple pages and photos to PDF

com.novosoft.TurboScan

Business

Yammer

wefwef

Education

Duolingo – Learn Languages for Free

com.duolingo.DuolingoMobile

Education

SkyView® Free – Explore the Universe

com.t11.celestefree

Entertainment

ABC – Watch Live TV & Stream Full Episodes

com.abcdigital.abc.videoplayer

Entertainment

Amazon Video

com.amazon.aiv.AIVApp

Entertainment

CBS

com.cbsvideo.app

Entertainment

DIRECTV

com.directv.DTViPhone

Entertainment

DIRECTV App for iPad

com.directv.mobile.ipad.navigator.production

Entertainment

Fandango Movies – Times + Tickets

com.fandango.fandango

Entertainment

HBO GO

com.hbo.hbogo

Entertainment

Hulu: Watch the latest TV Shows & stream Movies

com.hulu.plus

Entertainment

IMDb Movies & TV

com.imdb.imdb

Entertainment

Movies by Flixster, with Rotten Tomatoes

com.jeffreygrossman.moviesapp

Entertainment

NBC – Watch Now and Stream Full TV Episodes

com.nbcuni.nbc.portal

Entertainment

Netflix

com.netflix.Netflix

Entertainment

Redbox

com.redbox.m

Entertainment

StubHub – Sports, Concert & Theatre Tickets

com.stubhub.stubhub

Entertainment

Ticketmaster -Tickets for Concerts, Sports & Shows

com.ticketmaster.ios.TicketmasterApp

Entertainment

XFINITY TV Go

com.comcast.cim.xplay

Finance

Amex Mobile

com.americanexpress.amexservice

Finance

Bank of America – Mobile Banking

com.bankofamerica.BofA

Finance

Bloomberg

com.bloomberg.Bloomberg

Finance

Capital One Mobile

com.capitalone.enterprisemobilebanking

Finance

Chase Mobile℠

com.chase

Finance

Citi Mobile®

com.citigroup.citimobile

Finance

Fidelity Investments

com.fidelity.watchlist

Finance

Mint: Money Manager, Budget & Personal Finance

com.mint.internal

Finance

PayPal – Send money quickly and safely

com.yourcompany.PPClient

Finance

USAA – Insurance Banking Investments Retirement Advice

com.usaa.UsaaMobile

Finance

Wells Fargo Mobile

com.wf.mobilebanking

Food & Drink

Nowait Guest

com.nowaitapp.consumer

Food & Drink

OpenTable – Restaurant Reservations

com.contextoptional.OpenTable

Food & Drink

UberEATS: Food Delivery, Fast

com.ubercab.UberEats

Food & Drink

Urbanspoon – Restaurant & Food Reviews

com.urbanspoon.urbanspin

Food & Drink

Vivino Wine Scanner

com.vivino

Food & Drink

Zomato – Food & Restaurant Finder

com.zomato.zomato

Games

2048

com.ketchapp.2048

Games

▻Sudoku

com.fingerarts.sudoku2

Games

Candy Crush Saga

com.midasplayer.apps.candycrushsaga

Games

Candy Crush Soda Saga

com.midasplayer.apps.candycrushsodasaga

Games

Clash of Clans

com.supercell.magic

Games

Pokémon GO

com.nianticlabs.pokemongo

Games

Solitaire

com.mobilityware.SolitaireFree

Games

Trivia Crack

com.etermax.preguntados

Games

Words With Friends: Free Word Game – Fun for All

com.newtoyinc.NewWordsWithFriendsFree

Health & Fitness

Calorie Counter & Diet Tracker by MyFitnessPal

com.myfitnesspal.mfp

Health & Fitness

Fitbit

com.fitbit.FitbitMobile

Health & Fitness

Garmin Connect™ Mobile

com.garmin.connect.mobile

Health & Fitness

Map My Run – GPS Running & Workout Tracker

Q5AWL8WCY6.iMapMyRun

Health & Fitness

Nike+ Run Club

com.nike.nikeplus-gps

Health & Fitness

Runkeeper – GPS Running

RunKeeperPro

Health & Fitness

Strava Running and Cycling GPS

com.strava.stravaride

Lifestyle

AroundMe

com.tweakersoft.AroundMe

Lifestyle

Houzz Interior Design Ideas

com.houzz.app

Lifestyle

Nest – Your home in your hand

com.nestlabs.jasper.release

Lifestyle

Real Estate by Trulia – Homes for Sale, Apartments for Rent & Open Houses

com.trulia.Trulia

Lifestyle

Realtor.com Real Estate – Homes for Sale or Rent

com.move.Realtor

Lifestyle

Zillow Real Estate – Homes for Sale & for Rent

com.zillow.ZillowMap

Medical

Epocrates Reference Tools for Healthcare Providers

com.Epocrates.Rx

Medical

Medscape

com.medscape.mobile

Medical

MyChart

com.epic.mychart

Music

Amazon Music with Prime Music

com.amazon.mp3.AmazonCloudPlayer

Music

iHeartRadio – Free Music & Radio Stations

com.clearchannel.iheartradio

Music

Pandora – Free Music & Radio

com.pandora

Music

Shazam – Discover music, artists, videos & lyrics

com.shazam.Shazam

Music

SiriusXM Radio – Music, Talk, Comedy, Sports, More

com.siriusxm.siriusxmonline

Music

Sonos Controller

com.sonos.SonosController

Music

SoundCloud – Music & Audio

com.soundcloud.TouchApp

Music

SoundHound + hands-free with “OK Hound” | Search, Discover and Play Music

com.melodis.soundhound.free

Music

Spotify Music

com.spotify.client

Music

TuneIn Radio – NFL Audiobooks Podcasts Music

com.tunein.TuneInRadio

Navigation

MapQuest: Free Navigation, GPS, Maps & Traffic

com.aol.mapquest

Navigation

Transit • Real-Time App for Bus, Subway & Metro

com.samvermette.Transit

Navigation

Waze – GPS Navigation, Maps & Social Traffic

com.waze.iphone

News

Australian Broadcasting Corporation for iPad

com.abc.abciPad

News

BBC News

uk.co.bbc.news

News

CNN App for iPad

com.cnn.cnnipad

News

CNN App for iPhone

com.cnn.iphone

News

Flipboard: Your Social News Magazine

com.flipboard.flipboard-ipad

News

Fox News

com.foxnews.foxnews

News

NPR News

org.npr.nprnews

News

NYTimes – Breaking Local, National & World News

com.nytimes.NYTimes

News

The Wall Street Journal – Business & Markets News

com.dowjones.WSJ.ipad

News

Twitter

com.atebits.Tweetie2

News

USA TODAY

com.usatoday.iPhone20

News

Yahoo – News, Finance, Business, Sports & More

com.yahoo.frontpage

Photo & Video

Adobe Photoshop Express

com.adobe.PSMobile

Photo & Video

GoPro App

com.gopro.GoPro

Photo & Video

Instagram

com.burbn.instagram

Photo & Video

Layout from Instagram

com.burbn.layouts

Photo & Video

Snapchat

com.toyopagroup.picaboo

Photo & Video

Vimeo

com.vimeo

Productivity

Backup Assistant

com.fusionone.ct

Productivity

CamScanner Free| PDF Document Scanner and OCR

com.intsig.CamScannerLite

Productivity

Dropbox

com.getdropbox.Dropbox

Productivity

Evernote – stay organized

com.evernote.iPhone.Evernote

Productivity

Microsoft Excel

com.microsoft.Office.Excel

Productivity

Microsoft OneDrive – File & photo cloud storage

com.microsoft.skydrive

Productivity

Microsoft OneNote

com.microsoft.onenote

Productivity

Microsoft Outlook – email and calendar

com.microsoft.Office.Outlook

Productivity

Microsoft PowerPoint

com.microsoft.Office.Powerpoint

Productivity

Microsoft Word

com.microsoft.Office.Word

Productivity

Office Lens

com.microsoft.officelens

Productivity

Yahoo Mail – Keeps You Organized!

com.yahoo.Aerogram

Reference

Bible

tv.lifechurch.bible

Reference

Dictionary.com Dictionary & Thesaurus

com.reference.dictionary.dictionary

Reference

Wikipedia

org.wikimedia.wikipedia

Shopping

Amazon App: shop, scan, compare, and read reviews

com.amazon.Amazon

Shopping

Cartwheel by Target

com.target.Cartwheel

Shopping

eBay: Buy & Sell Electronics, Fashion and More

com.ebay.iphone

Shopping

Etsy: Shop Handmade, Vintage & Creative Goods

com.etsy.etsyforios

Shopping

Flipp – Weekly Ads, Shopping List, and Coupons

com.wishabi.Flipp-iOS

Shopping

Groupon – Deal, Coupon & Discount Shopping App

com.groupon.grouponapp

Shopping

Walmart App: Shopping, Savings Catcher, & More

com.walmart.electronics

Social Networking

BBM

com.blackberry.bbm1

Social Networking

Facebook

com.facebook.Facebook

Social Networking

GroupMe

com.groupme.iphone-app

Social Networking

LinkedIn

com.linkedin.LinkedIn

Social Networking

Messenger

com.facebook.Messenger

Social Networking

Periscope – Live Video Streaming Around the World

com.bountylabs.periscope

Social Networking

Pinterest

pinterest

Social Networking

Skype for iPad

com.skype.SkypeForiPad

Social Networking

Skype for iPhone

com.skype.skype

Social Networking

Viber

com.viber

Social Networking

WeChat

com.tencent.xin

Social Networking

WhatsApp Messenger

net.whatsapp.WhatsApp

Sports

CBS Sports

H443NM7F8H.CBSSportsApp

Sports

ESPN – Get scores, news, and watch live sports

com.espn.ScoreCenter

Sports

ESPN Fantasy Football Baseball Basketball Hockey

com.espn.fantasyFootball

Sports

FOX Sports GO

com.uie.foxsports.foxsportsgo

Sports

MLB.com At Bat

com.mlb.AtBatUniversal

Sports

NBC Sports

com.nbcuni.com.nbcsports.liveextra

Sports

NFL

com.nfl.gamecenter

Sports

TeamSnap – Sports Team Management

com.teamsnap.ios

Sports

theScore – Sports Scores & News

iphone.thescore.com

Sports

WatchESPN

com.espn.WatchESPN

Sports

Yahoo Fantasy Football Basketball Hockey Baseball

com.yahoo.ffootball2009

Sports

Yahoo Sports – your teams, your scores, your news

com.softacular.Sportacular

Travel

Air Canada

com.aircanada.csp.aciclient

Travel

Airbnb

com.airbnb.app

Travel

American Airlines

com.aa.AmericanAirlines

Travel

Booking.com Worldwide Hotel Reservations & Deals

com.booking.BookingApp

Travel

CWT To Go

com.worldmate.cwt2go

Travel

Expedia Hotel, Flights, Car Rental & Activities

com.expedia.booking

Travel

FlightAware Flight Tracker

com.flightaware.iphone.live-flight-tracker

Travel

Fly Delta

com.delta.iphone.ver1

Travel

GasBuddy: Fuel Your Journey

com.gasbuddymobile.gasbuddy

Travel

Gogo Entertainment

com.gogoair.ife

Travel

Hilton HHonors

com.hilton.hhonors

Travel

IHG® – Hotel Booking, Reservations & Deals

com.ihg.priorityclubrewards

Travel

JetBlue

com.jetblue.jetBlueiPhone

Travel

KAYAK Flights, Hotels & Cars

com.kayak.travel

Travel

Lufthansa

com.lufthansa.launcher

Travel

Lyft – Taxi App Alternative

com.zimride.instant

Travel

Marriott International

com.marriott.iphoneprod

Travel

My Disney Experience – Walt Disney World

com.disney.MyDisneyExperience

Travel

Southwest Airlines

com.southwest.iphoneprod

Travel

SPG: Starwood Hotels & Resorts

com.starwoodhotels.spg

Travel

TripAdvisor Hotels Flights Restaurants

com.tripadvisor.LocalPicks

Travel

TripCase

com.sabre.tripcase.prod

Travel

TripIt: Travel Organizer

com.tripit.tripitmobile

Travel

Uber

com.ubercab.UberClient

Travel

United Airlines

com.united.UnitedCustomerFacingIPhone

Travel

XE Currency

com.xe.XECurrency

Travel

Yelp

com.yelp.yelpiphone

Utilities

Bitmoji – Your Personal Emoji

com.bitstrips.imoji

Utilities

Firefox web browser

org.mozilla.ios.Firefox

Utilities

FlashlightⓄ

com.ihandysoft.flashlight.led.pro

Utilities

My Verizon

com.vzw.hss.myverizon

Utilities

QR Code Reader by Scan

me.scan.qrcodereader

Utilities

QR Reader for iPhone

com.TapMediaLtd.QRReader

Utilities

Quick Scan – QR Code Reader

com.ihandysoft.barcode.qr.free

Utilities

RedLaser – Barcode Scanner, Shopping Assistant & QR Code Reader

com.ebay.redlaserproper

Utilities

Speedtest.net Speed Test

com.ookla.speedtest

Utilities

The Calculator Free

com.itwcalculator.calculatorforipadfree

Weather

AccuWeather – Weather for Life

com.yourcompany.TestWithCustomTabs

Weather

MyRadar NOAA Weather Radar – Forecasts, Storms, and Earthquakes

com.fboweb.MyRadar

Weather

NOAA Weather Radar – Weather, National Forecast Maps & Live Doppler Radars

com.apalonapps.radarfree

Weather

Storm – Radar, Storm Tracking, Hurricanes, Accurate Lightning & Precipitation Alerts

com.wunderground.storm

Weather

The Weather Channel App for iPad – best local forecast, radar map, and storm tracking

com.weather.TWCiPadMax

Weather

The Weather Channel-Temperature, Alerts & Warnings

com.weather.TWC

Weather

Weather Underground

com.wunderground.weatherunderground

Weather

WeatherBug – Free Local Weather Forecast, Radar Map & Severe Storm Alerts

com.aws.weatherbug.pro

Weather

Yahoo Weather

com.yahoo.weather

Back