Israeli Start-Up Leaks Data on 31m Users

07 December, 2017, 04:31 | Author: Oscar Goodwin
  • Popular Keyboard App with Tens of Millions of Downloads Leaks Data of Its 31 Million Users

Another data leak case has surfaced wherein the personal details of almost 31 million Android users using the AI.type app has been exposed on an online open database.

Speaking to the BBC, however, ai.type's founder and chief executive, Eitan Fitusi, referred to the leaked database as "a secondary database", and denied the scale of exposed data was as high as claimed.

But the security researchers found that this isn't the case, given that not only was there an unsecured server sitting full of user data, but the texts weren't encrypted either as they were able to download and look through the database files where they found a table containing 8.6 million entries of text that had been typed into the keyboard app.

In the course of an weeks-long investigation, Kromtech Security Center discovered that a misconfigured MongoDB database allowed them to access data from almost 31 million users. Users of the app may want to think twice about typing any sensitive information while using the app, as it is likely to be sucked up and stored in a server.

Data including phone numbers, a user's name, their device name and model, network name, screen resolution, user language and Android version are reportedly compromised - as well as extraordinary details that many user's likely never knew the app could see. Leaked records as per Kromtech Security, also had a range of other statistics like the most popular users' Google queries for different regions.

And if that wasn't bad enough, in some cases the exposed data also included IP addresses, phone numbers, internet providers and Google account information, which in turn reveals web browser history, dates of birth, profile photos and even details on all the apps installed on the user's phone.

The data was only secured after the firm made several attempts to contact Fitusi, who acknowledged the security lapse this weekend.

Popular Keyboard App with Tens of Millions of Downloads Leaks Data of Its 31 Million Users
Data-slurping keyboard app makes Mongo mistake with user data

Bob Diachenko, head of communications at Kromtech Security Center, said: 'Theoretically, it is logical that anyone who has downloaded and installed the Ai.Type virtual keyboard on their phone has had all of their phone data exposed publicly online.

Any text entered on the keyboard 'stays encrypted and private, ' says the company.

AI.type says on its website that user's privacy 'is our main concern'. Ai.Type was also collecting data from user's contact lists, according to the researchers.

"Why would a keyboard and emoji application need to gather the entire data of the user's phone or tablet?" Android users who install the free version of the app might be scared away by an alert that says the keyboard may collect "all the text you type", including passwords and credit card numbers.

"This presents a real danger for cyber criminals who could commit fraud or scams using such detailed information about the user", he added.

"It raises the question once again if it is really worth it for consumers to submit their data in exchange for free or discounted products", the company said in its blog post. "This also exposed just how much data they access and how they obtain a treasure trove of data that average users not do expect to be extracted or data-mined from their phone or tablet". However, he outlined that most of the data was insensitive.

Recommended:

  • A 'Super Earth' that may host alien life identified

    A 'Super Earth' that may host alien life identified

    Astronomers have identified a distant exoplanet as a "super-Earth" that has the potential to harbor alien life . JWST is NASA's successor to the Hubble Space Telescope and is now scheduled to be launched in spring 2019.
    Reilly Financial Advisors LLC Holds Stake in Home Depot INC (HD)

    Reilly Financial Advisors LLC Holds Stake in Home Depot INC (HD)

    Taking current value along prior value is a smoothing technique similar to that used in calculating an exponential moving average. Zacks Investment Research cut shares of Home Depot from a "buy" rating to a "hold" rating in a report on Wednesday, August 30th.
    Call Of Duty WW2's Winter Siege Event Trailer And Details Unveiled

    Call Of Duty WW2's Winter Siege Event Trailer And Details Unveiled

    Activities include the return of Gun Game mode, double XP playlists, Weekly Orders, Weekly Contracts, and Daily Order challenges. Winter Siege Supply Drops can be earned for free simply by playing Call of Duty: WWII during the event.
  • Giants GM says parameters of Stanton trade have been reached

    Giants GM says parameters of Stanton trade have been reached

    In the meantime, a handful of players on those teams have taken to social media to try to influence Stanton to join them. The Giants and Marlins have reportedly agreed on a general framework , but the decision ultimately comes down to Stanton.
    Tour de Yorkshire 2018: Mark Cavendish to compete in four-day race

    Tour de Yorkshire 2018: Mark Cavendish to compete in four-day race

    On Sunday, May 5, the third stage starts in Richmond and finishes in Scarborough but will include the race's first visit to Filey. Day one, on May 3, startes in Beverley and heads to Hornsea and through to Wolds to Pocklington before finishing in Doncaster.
    Valve is ending support for Steam purchases in Bitcoin

    Valve is ending support for Steam purchases in Bitcoin

    There are some major companies , such as Microsoft and DISH, accepting bitcoin payment, but few others have followed suit. One of those companies is Valve , which up until today accepted Bitcoin as a payment method on Steam .
  • Nigerians returned from Libya

    Nigerians returned from Libya

    He also confirmed that four of the returnees had medical cases and were promptly taken away on an ambulance for treatment. As at the time of filing this report , another batch of about 250 returnees are being expected.
    'Long Island Medium' Theresa Caputo & husband split after 28 years

    'Long Island Medium' Theresa Caputo & husband split after 28 years

    On the show's season finale, the couple chose to take their therapist's advice and agreed to spend some time apart. I don't want to make it just about me.
    China evades comment on Chabahar port launch in Iran

    China evades comment on Chabahar port launch in Iran

    Furthermore, Iran will never allow India's Central Asian dream to be juxtapositioned vis-à-vis Tehran's regional interests. That corridor links up Russia, Central Asian Republics and Iran through road, rail and shipping networks.
  • Rye Fire In Santa Clarita Only 5% Contained, Thousands Evacuated

    Rye Fire In Santa Clarita Only 5% Contained, Thousands Evacuated

    He added that the firefighters have a "really good" perimeter surrounding the fire and they hope to have a good handle on it. Power was interrupted to about 2,090 customers in the Santa Clarita area, according to Southern California Edison.

    Stock Stepping Up to a Recent High: McDonald's Corporation (NYSE:MCD)

    Huntington National Bank decreased Helmerich & Payne Inc (NYSE:HP) stake by 7,668 shares to 3,676 valued at $200,000 in 2017Q2. Signature Financial Mgmt invested in 2,077 shares or 0.09% of the stock. 123 funds opened positions while 686 raised stakes.
    London pollution is so bad that there's not much point exercising

    London pollution is so bad that there's not much point exercising

    Likewise the increase in blood flow usually associated with exercise was virtually absent in those walking along the busy shopping street .


Popular

Bryan Singer Fired From Queen Biopic Bohemian Rhapsody
Robot ) and his iconic rock band, Queen . "Unfortunately, the studio was unwilling to accommodate me and terminated my services". However, his reputation has been called into question after the Harvey Weinstein allegations hit the mainstream press.

Premier League clubs set a new Champions League record
When is the draw and when are the games? Round of 16 first-leg games are played from February 13-21. Chelsea: Barcelona , Paris Saint-Germain, Besiktas, Spartak Moscow or Sevilla.

Donald Trump Jr. Asked Russian Lawyer for Info on Clinton Foundation
Kushner, Ike Kaveladze, who was at the meeting as a representative of a Russian developer who once partnered with Mr. Trump, Jr.'s refusal to testify before the Committee means that key questions have been left unanswered", he said.

Liverpool, Sevilla, Porto, Shakhtar into Champions League last 16
The result sees Jurgen Klopp's side top the group, while a draw would have also been enough to see them reach the last 16. Just minutes into the game Georgi Dzhikiya pulled down Mohamed Salah as Coutinho drifted a ball into the area.

European Union adopts blacklist of 17 tax havens
The EU published its first "blacklist" of tax havens on Tuesday, naming 17 countries including Barbados, Panama , and St Lucia. To stay off the list, countries must meet three criteria or promise to reform their systems to comply.