A major chat log database belonging to popular messaging app JusTalk was left unprotected on the web for months, accessible to anyone who knew where to look.
Cybersecurity researcher Anurag Sen uncovered the database, which did not have a password, storing unencrypted data including plenty of personally identifiable information, useful for cybercriminals looking to engage in identity theft (opens in new tab), social engineering, or other forms of cybercrime.
The data included the messages themselves, user phone numbers (both sender and receiver), call logs, all sorted out just enough to be able to identify specific people and specific conversations.
Millions of potential victims
In fact, while going through the logs, TechCrunch says it managed to find a pastor soliciting a sex worker who listed their phone number publicly. The log included the time, location, and price of the meeting.
The database itself is “hundreds of gigabytes” large, and hosted on a Huawei server in China. In order to access it, the only thing a person would need is a browser, and its IP address. With the help of database search engine Shodan, the researcher discovered that the server was storing new data in the database as early as January this year, when it was first exposed.
It’s impossible to know exactly how many people have had their sensitive data exposed in this blunder, but we do know that JusTalk has roughly 20 million users. It also has JusTalk Kids, a separate app for minors, with more than a million downloads on Android.
After Sen reported the problem to JusTalk, it apparently shut down the database, but also decided not to comment on the findings.
Sen was also apparently not the first to discover this database, as it contained a ransom note, meaning someone had tried to use it to extort money from the company, but whether or not they succeeded is unknown at this time.
Via: TechCrunch (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba