JusTalk has been leaking user info for months
A major database with sensitive data was sitting open for months
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A major chat log database belonging to popular messaging app JusTalk was left unprotected on the web for months, accessible to anyone who knew where to look.
Cybersecurity researcher Anurag Sen uncovered the database, which did not have a password, storing unencrypted data including plenty of personally identifiable information, useful for cybercriminals looking to engage inidentity theft, social engineering, or other forms of cybercrime.
The data included the messages themselves, user phone numbers (both sender and receiver), call logs, all sorted out just enough to be able to identify specific people and specific conversations.
Millions of potential victims
In fact, while going through the logs,TechCrunchsays it managed to find a pastor soliciting a sex worker who listed their phone number publicly. The log included the time, location, and price of the meeting.
The database itself is “hundreds of gigabytes” large, and hosted on a Huawei server in China. In order to access it, the only thing a person would need is a browser, and its IP address. With the help of database search engine Shodan, the researcher discovered that the server was storing new data in the database as early as January this year, when it was first exposed.
It’s impossible to know exactly how many people have had their sensitive data exposed in this blunder, but we do know that JusTalk has roughly 20 million users. It also has JusTalk Kids, a separate app for minors, with more than a million downloads on Android.
These countries have the most exposed databases online>Anti-vax dating site exposed data of thousands of users>These are the best endpoint protection services right now
After Sen reported the problem to JusTalk, it apparently shut down the database, but also decided not to comment on the findings.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sen was also apparently not the first to discover this database, as it contained a ransom note, meaning someone had tried to use it to extort money from the company, but whether or not they succeeded is unknown at this time.
Via:TechCrunch
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Thousands of employees could be falling victim to obvious phishing scams every month
