Popular animated avatar creator app Boomoji, with more than five million users across the world, exposed the personal data of its entire user base after it failed to put passwords on two of its internet-facing databases.
The China-based app developer left the ElasticSearch databases online without passwords — a U.S.-based database for its international customers; and a Hong Kong-based database containing mostly Chinese users’ data in an effort to comply with China’s data security laws, which requires Chinese citizens’ data to be located on servers inside the country.
Anyone who knew where to look could access, edit or delete the database using their web browser. And, because the database was listed on Shodan, a search engine for exposed devices and databases, they was easily found with a few keywords.
After TechCrunch reached out, Boomoji pulled the two databases offline. “These two accounts were made by us for testing purposes,” said an unnamed Boomoji spokesperson in an email.
But that isn’t true.
The database contained records on all of the company’s iOS and Android users — some 5.3 million users as of this week. Each record contained their username, gender, country, and phone type.
Each record also included a user’s unique Boomoji ID, which was linked to other tables in the database. Those other tables included if and which school they go to — a feature Boomoji touts as a way for users to get in touch with their fellow students. That unique ID also included the precise geolocation of more than 375,000 users that had allowed the app to know their location at any given time.
Worse, the database contained every phone book entry of every user who had allowed the app access to their contacts.
One table had more than 125 million contacts, including their names (as written in a user’s phone book) and their phone number. Each record was linked to a Boomoji’s unique ID, making it relatively easy to know whose contact list belonged to whom.
Even if you didn’t use the app, anyone who has your phone number stored on their device and used the app more than likely uploaded your number to Boomoji’s database. To our knowledge, there’s no way to opt out or have your information deleted.
Given Boomoji’s response, we verified the contents of the database by downloading the app on a dedicated iPhone using a throwaway phone number, containing a few dummy, but easy-to-search contact list entries. To find friends, the app matches your contacts with those registered with the app in its database. When we were prompted to allow the app access to our contacts list, the entire dummy contact list was uploaded instantly — and viewable in the database.
So long as the app was installed and had access to the contacts, new phone numbers would be automatically uploaded.
Yet, none of the data was encrypted. All of the data was all stored in plaintext.
Although Boomoji is based in China, it claims to follow California state law, where data protection and privacy rules are some of the strongest in the U.S. We asked Boomoji if has or plans to inform California’s attorney general of the exposure as it’s required to by state law, but the company did not answer.
Given the vast amount of European users’ information in the database, the company may also face penalties under the EU’s General Data Protection Regulation, which can impose fines of up to four percent of the company’s global annual revenue for serious breaches.
But given its China-based presence, it’s not clear, however, what actionable repercussions the company could face.
This is the latest in a series of exposures involving ElasticSearch instances, a popular open source search and database software. In recent weeks, several high profile data exposures have been reported as a result of companies’ failure to practice basic data security measures — including Urban Massage exposing its own customer database, Mindbody-owned FitMetrix forgetting to put a password on its servers, and Voxox, a communications company, which leaked phone numbers and two-factor codes on millions of unsuspecting users.
Got a tip? You can send tips securely over Signal and WhatsApp to +1 646-755–8849. You can also send PGP email with the fingerprint: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.
Source: TechCrunch http://j.mp/2GcEZAB
No comments:
Post a Comment