Slashdot Mirror
Security Flaw In Truecaller Android App Exposes Data of Millions of Users (softpedia.com)
An anonymous reader writes about a newly found vulnerability in Truecaller: Security researchers have found a flaw in Truecaller, a popular service that indexes phone numbers and helps users block spammers and telemarketers. An article on Softpedia explains the vulnerability, "When users first install the Android app, they are prompted to enter their phone number, email address, and other personal details. This information is verified by phone call or SMS message. Upon opening the app for the second time, no login screens are shown. In a proof-of-concept code shared with Softpedia, researchers were able to retrieve personal details for other users based on an IMEI code just by interacting with the app's servers. The servers exposed data such as the user's Truecaller account name, his gender, email address, profile image, home address, and whatever else was stored in his profile. Additionally, the IMEI code also allowed the researchers to modify account settings."
Please do not worry, all these kinds of bugs will be patched before the Internet of Things is released.
A hacker's dream come true.
It's feasible, but how useful is it? You can of course loop through IMEI codes, but not every phone have registered so it will be some time before you get matching info.
But otherwise I agree - it's a weakness that should be protected better. It also highlights that too many services requests too much personal information.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
In addition to the usual lessons to app-developers, there is a lesson for users. Do not allow "apps" to know more, than what is required for them to fulfill the purpose you installed them for. And if they insist on such things (like access to your photographs), then do not install them.
With things like "true caller" it is bad enough that they know, who calls you — but they have a legitimate need to know. They do not need to know you, however.
In Soviet Washington the swamp drains you.
But the first thing to do is disable its access to your contacts.
Unfortunately, it has become such common practice to request "kitchen sink" permissions that it's nigh impossible to find useful apps that don't do so. And the sad fact is that users have become so jaded to it that the money that app makers lose from people who value privacy is less than the money they make from people just clicking through on ever "OK" button they see to get their new shiny.
I wish I had an answer to this problem, but I don't. People are stupid, and there's not much you can do to fix that. Unfortunately, that means that people like you and I who do care about our privacy pay the price.
Why was gender, home address, etc, stored on the servers? It appears that the apps was harvesting far more data than was needed to perform its core function.
Basically, this app is using the device IMEI as the login and password. Whoever thought this was a good idea lacks basic security principles.
Apps are hastily written and thrown by the dozen against the wall to see what sticks... they are the crappiest of the crap of all things internet and apps have not yet begun to leak you data,lose your privacy and compromise your devices... If you like using new trendy apps then expect to get a privacy VD.
If the app can, the app will. Does the app have your personal details? Then you don't have personal details, you replaced them with public details.
Does the app need to know your phone id and call status? Like, is the app a phone dialer, or not? No? Is it asking for that? Why would they ask for that? Would you give that out to a stranger on the sidewalk? Who you at least have a physical description of? Then why give it out to a strange computer, that is who knows where doing who knows what?
Come on, people... don't give out your phone number in order to track spam numbers... that is exactly the opposite direction than the information should be flowing there.
I installed that app once, but gave up because of the amount of personal data it asked, which I found unreasonable. Reading /. comments has made me somewhat paranoid, albeit not paranoid enough. Anyway, all this trouble with Truecaller could be avoided with a built-in caller blocker.
Linux is for people who don't mind RTFM.
We need more apps and less robots. My computer is a slave and it should mind its duties rather than be mouthing off about personal details.
I'm "paranoid" (or maybe I've just been around the block) enough that I mostly stick to F-Droid apps, and if it asks for more permissions than I want I just download the source, remove the permissions I don't like, and comment out any code that tries to use the errant permission.
Maybe 5% of the time they're even using for it something worthwhile... at times they're even going to the bother to store the phone id in the app's database (which is just a sqlite file) when they don't have internet permissions. But there is no way to differentiate between incompetent handling of my data, and future plans of adding internet permissions and misusing it.
A lot of the time I'm turning off all the internet access, because I'm not using any sort of social media data sharing with the app, and that is the only reason it asks for it. I really prefer to have my mobile apps load their data in advance in most cases, or talk directly to another computer over bluetooth instead of a routeable network.
It would have been so easy to generate a local secret and use it as an identifier instead of the IMEI...