A major chat log database belonging to popular messaging app JusTalk was left unprotected on the web for months, accessible to anyone who knew where to look.
Cybersecurity researcher Anurag Sen uncovered the database, which did not have a password, storing unencrypted data including plenty of personally identifiable information, useful for cybercriminals looking to engage in identity theft (opens in new tab), social engineering, or other forms of cybercrime.
The data included the messages themselves, user phone numbers (both sender and receiver), call logs, all sorted out just enough to be able to identify specific people and specific conversations.
Millions of potential victims
In fact, while going through the logs, TechCrunch says it managed to find a pastor soliciting a sex worker who listed their phone number publicly. The log included the time, location, and price of the meeting.
The database itself is “hundreds of gigabytes” large, and hosted on a Huawei server in China. In order to access it, the only thing a person would need is a browser, and its IP address. With the help of database search engine Shodan, the researcher discovered that the server was storing new data in the database as early as January this year, when it was first exposed.
It’s impossible to know exactly how many people have had their sensitive data exposed in this blunder, but we do know that JusTalk has roughly 20 million users. It also has JusTalk Kids, a separate app for minors, with more than a million downloads on Android.
After Sen reported the problem to JusTalk, it apparently shut down the database, but also decided not to comment on the findings.
Sen was also apparently not the first to discover this database, as it contained a ransom note, meaning someone had tried to use it to extort money from the company, but whether or not they succeeded is unknown at this time.
Via: TechCrunch (opens in new tab)
