Caller ID and spam blocking company Truecaller recently launched its “Guardian” application that allows users to share their live locations with the trusted guardians in their contact lists. Anand Prakash, cybersecurity expert based in Bangalore, however, pointed out that the app had a major vulnerability and Truecaller soon fixed it. The individual security app has an emergency option that informs the user’s selected peers of his/her live location, which gives real-time information during any emergency. Mr. Prakash who founded Pingsafe, a cybersecurity startup, says that the vulnerability could allow any potential threat actor to gain access into any user’s account via using a phone number.
Later, the hacker could hijack the user account and take all its data, this may include the live location (both user and emergency contacts), user date of birth, and profile picture. Guardian was released on 3rd March and has over 1,00,000 downloads on the play store. “We are using an encrypted line between the two different clients…So that actually means that you can’t revisit a previous journey because we don’t store that data…The data that is shared with the ‘forever sharing’ option is the state of battery and signal, along with the location to help the trusted guardians follow the user,” says Truecaller. Mr. Prakash contacted Truecaller the next day, notifying the latter about the vulnerability.
Basic API error was the reason for the flaw. If API (Application Programming Interfaces) problems persist, it allows attackers to access website data and software, generally not accessible to a user. Mr. Prakash says he immediately looked into the app after its release and soon discovered issues with the app. using the “login API” option in the app, the researcher was able to gain access to another person’s profile using his phone number.
A similar pattern was tried with other contacts and the issue was reported to Truecaller. The company soon fixed the issue and later notified the expert. Mr. Prakash identified the issue as an “Insecure Direct Object Interference” flaw. PingSafe’s report says, “companies tend to miss out on such fundamental issues even after rigorous security assessments. The repercussions of such problems are enormous and impact customers’ privacy and lead to companies’ revenue losses.”
If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.Ok
