Another day, another clamorous data breach, this time let’s discuss a data breach that exposes personal data collected by the Keyboard App AI.type.
This story reminds us that every time we download an app we
are enlarging our surface of attack, in the majority of cases we are
not aware of exact amount of data they collect and how they use them
The data was included in a MongoDB database that has been accidentally exposed online without any mechanism of protection.
“The Kromtech Security Center has discovered a massive
amount of customer files leaked online and publically available.
Researchers were able to access the data and details of 31,293,959
users.” states the post published by Kromtech Security.
“The misconfigured MongoDB database appears to belong
to Ai.Type a Tel Aviv-based startup that designs and develops a
personalized keyboard for mobile phones and tablets for both Android and
iOS devices.”
Ai.Type was founded in 2010, its customizable and personalizable
on-screen keyboard for Android was downloaded about 40 million times
from the Google Play store.
The misconfigured MongoDB database
exposed 577 GB of data online, the records include sensitive details on
the users, and the worst thing is that such data was not even necessary
for the app to work. Researchers highlighted the fact that the Ai.Type
request “Full Access” to all data stored on the mobile devices.
“When researchers installed Ai.Type they were shocked to discover that users must allow “Full Access” to all of their data stored on the testng iPhone, including all keyboard data past and present. It raises the question of why would a keyboard and emoji application need to gather the entire data of the user’s phone or tablet?” continues the post.
“Based on the leaked database they appear to collect everything from contacts to keystrokes. This is a shocking amount of information on their users who assume they are getting a simple keyboard application.”
The leaked data includes:
- Full name, phone number, and email address
- Device name, screen resolution and model details
- Android version, IMSI number, and IMEI number
- Mobile network name, country of residence and even user enabled languages
- IP address (if available), along with GPS location (longitude/latitude).
- Links and the information associated with the social media profiles, including birth date, emails, photos.
The archive also includes a range of statistics.
“There was a range of other statistics like the most popular users’ Google queries for different regions. Data like average messages per day, words per message, the age of users, words_per_day’: 0.0, ‘word_per_session and a detailed look at their customers,” the researchers say.
No comments:
Post a Comment