Slashdot Mirror
Security Flaw In Truecaller Android App Exposes Data of Millions of Users (softpedia.com)
An anonymous reader writes about a newly found vulnerability in Truecaller: Security researchers have found a flaw in Truecaller, a popular service that indexes phone numbers and helps users block spammers and telemarketers. An article on Softpedia explains the vulnerability, "When users first install the Android app, they are prompted to enter their phone number, email address, and other personal details. This information is verified by phone call or SMS message. Upon opening the app for the second time, no login screens are shown. In a proof-of-concept code shared with Softpedia, researchers were able to retrieve personal details for other users based on an IMEI code just by interacting with the app's servers. The servers exposed data such as the user's Truecaller account name, his gender, email address, profile image, home address, and whatever else was stored in his profile. Additionally, the IMEI code also allowed the researchers to modify account settings."
Apps!
Please do not worry, all these kinds of bugs will be patched before the Internet of Things is released.
A hacker's dream come true.
It's feasible, but how useful is it? You can of course loop through IMEI codes, but not every phone have registered so it will be some time before you get matching info.
But otherwise I agree - it's a weakness that should be protected better. It also highlights that too many services requests too much personal information.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
In addition to the usual lessons to app-developers, there is a lesson for users. Do not allow "apps" to know more, than what is required for them to fulfill the purpose you installed them for. And if they insist on such things (like access to your photographs), then do not install them.
With things like "true caller" it is bad enough that they know, who calls you — but they have a legitimate need to know. They do not need to know you, however.
In Soviet Washington the swamp drains you.
But the first thing to do is disable its access to your contacts.
Unfortunately, it has become such common practice to request "kitchen sink" permissions that it's nigh impossible to find useful apps that don't do so. And the sad fact is that users have become so jaded to it that the money that app makers lose from people who value privacy is less than the money they make from people just clicking through on ever "OK" button they see to get their new shiny.
I wish I had an answer to this problem, but I don't. People are stupid, and there's not much you can do to fix that. Unfortunately, that means that people like you and I who do care about our privacy pay the price.
Why was gender, home address, etc, stored on the servers? It appears that the apps was harvesting far more data than was needed to perform its core function.
Basically, this app is using the device IMEI as the login and password. Whoever thought this was a good idea lacks basic security principles.
Apps are hastily written and thrown by the dozen against the wall to see what sticks... they are the crappiest of the crap of all things internet and apps have not yet begun to leak you data,lose your privacy and compromise your devices... If you like using new trendy apps then expect to get a privacy VD.
We need more apps and less robots. My computer is a slave and it should mind its duties rather than be mouthing off about personal details.
It would have been so easy to generate a local secret and use it as an identifier instead of the IMEI...