From Digital Age to Nano Age. WorldWide.

Tag: exposed

Atoms Lanka Solutions > exposed
Robotic Automations

India's ICICI Bank exposed thousands of credit cards to 'wrong' users | TechCrunch

April 25, 2024 5:23 PM0


ICICI Bank, one of India’s top private banks, exposed the sensitive data of thousands of new credit cards to customers who were not their intended recipients.

The Mumbai-based bank confirmed to TechCrunch Thursday that its digital channels “erroneously mapped” about 17,000 credit cards issued in the past few days to “wrong” users. The issue came to light after some customers raised concerns on social media about the bank’s iMobile Pay app exposing unknown customers’ credit card details, including their full number and card verification value (CVV).

“Our customers are our utmost priority, and we are wholeheartedly dedicated to safe guarding their interests,” said Kausik Datta, corporate communications head at ICICI Bank, said in a statement emailed to TechCrunch. “We regret the inconvenience caused. No instance of misuse of a card from this set has been reported to us. However, we assure that the Bank will appropriately compensate a customer in case of any financial loss.”

The spokesperson added that the number of impacted credit cards constituted about 0.1% of the bank’s credit card portfolio.

As reported by the finance-related forum Technofino, sensitive data such as the full card number, expiry date and CVV of unknown customers’ credit cards suddenly appeared for some users on the iMobile Pay app.

“I have access to someone else’s Amazon Pay CC due to a security glitch on the iMobile app. Although OTP restricts domestic transactions, but I can do international transactions using the details from the iMobile app,” one of the users wrote on the forum.

The bank spokesperson told TechCrunch it blocked the affected cards and is issuing new cards to customers.

ICICI Bank, which has over 6,000 branches in India, is in 17 countries worldwide. The iMobile Pay app, launched in 2008, has over 28 million users.


Software Development in Sri Lanka

Robotic Automations

Security bugs in popular phone-tracking app iSharing exposed users' precise locations | TechCrunch

April 25, 2024 4:27 AM0


Last week when a security researcher said he could easily obtain the precise location from any one of the millions of users of a widely used phone-tracking app, we had to see it for ourselves.

Eric Daigle, a computer science and economics student at the University of British Columbia in Vancouver, found the vulnerabilities in the tracking app iSharing as part of an investigation into the security of location-tracking apps. iSharing is one of the more popular location-tracking apps, claiming more than 35 million users to date.

Daigle said the bugs allowed anyone using the app to access anyone else’s coordinates, even if the user wasn’t actively sharing their location data with anybody else. The bugs also exposed the user’s name, profile photo and the email address and phone number used to log in to the app.

The bugs meant that iSharing’s servers were not properly checking that app users were only allowed to access their location data or someone else’s location data shared with them.

Location-tracking apps — including stealthy “stalkerware” apps — have a history of security mishaps that risk leaking or exposing users’ precise location.

In this case, it took Daigle only a few seconds to locate this reporter down to a few feet. Using an Android phone with the iSharing app installed and a new user account, we asked the researcher if he could pull our precise location using the bugs.

“770 Broadway in Manhattan?” Daigle responded, along with the precise coordinates of TechCrunch’s office in New York from where the phone was pinging out its location.

The security researcher pulled our precise location data from iSharing’s servers, even though the app was not sharing our location with anybody else. Image Credits: TechCrunch (screenshot)

Daigle shared details of the vulnerability with iSharing some two weeks earlier but had not heard anything back. That’s when Daigle asked TechCrunch for help in contacting the app makers. iSharing fixed the bugs soon after or during the weekend of April 20-21.

“We are grateful to the researcher for discovering this issue so we could get ahead of it,” iSharing co-founder Yongjae Chuh told TechCrunch in an email. “Our team is currently planning on working with security professionals to add any necessary security measures to make sure every user’s data is protected.”

iSharing blamed the vulnerability on a feature it calls groups, which allows users to share their location with other users. Chuh told TechCrunch that the company’s logs showed there was no evidence that the bugs were found prior to Daigle’s discovery. Chuh conceded that there “may have been oversight on our end,” because its servers were failing to check if users were allowed to join a group of other users.

TechCrunch held the publication of this story until Daigle confirmed the fix.

“Finding the initial flaw in total was probably an hour or so from opening the app, figuring out the form of the requests, and seeing that creating a group on another user and joining it worked,” Daigle told TechCrunch.

From there, he spent a few more hours building a proof-of-concept script to demonstrate the security bug.

Daigle, who described the vulnerabilities in more detail on his blog, said he plans to continue research in the stalkerware and location-tracking area.

Read more on TechCrunch:

To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.


Software Development in Sri Lanka

Robotic Automations

Microsoft employees exposed internal passwords in security lapse | TechCrunch

April 18, 2024 1:39 AM0


Microsoft has resolved a security lapse that exposed internal company files and credentials to the open internet.

Security researchers Can Yoleri, Murat Özfidan and Egemen Koçhisarlı with SOCRadar, a cybersecurity company that helps organizations find security weaknesses, discovered an open and public storage server hosted on Microsoft’s Azure cloud service that was storing internal information relating to Microsoft’s Bing search engine.

The Azure storage server housed code, scripts and configuration files containing passwords, keys and credentials used by the Microsoft employees for accessing other internal databases and systems.

But the storage server itself was not protected with a password and could be accessed by anyone on the internet.

Yoleri told TechCrunch that the exposed data could potentially help malicious actors identify or access other places where Microsoft stores its internal files. Identifying those storage locations “could result in more significant data leaks and possibly compromise the services in use,” Yoleri said.

The researchers notified Microsoft of the security lapse on February 6, and Microsoft secured the spilling files on March 5.

When reached by email, a spokesperson for Microsoft did not provide comment by the time of publication. In a statement shared after publication on Wednesday, Microsoft’s Jeff Jones told TechCrunch: “Though the credentials should not have been exposed, they were temporary, accessible only from internal networks, and disabled after testing. We thank our partners for responsibly reporting this issue.”

Jones did not say for how long the cloud server was exposed to the internet, or if anyone other than SOCRadar discovered the exposed data inside.

This is the latest security gaffe at Microsoft as the company tries to rebuild trust with its customers after a series of cloud security incidents in recent years. In a similar security lapse last year, researchers found that Microsoft employees were exposing their own corporate network logins in code published to GitHub.

Microsoft also came under fire last year after the company admitted it did not know how China-backed hackers stole an internal email signing key that allowed the hackers broad access to Microsoft-hosted inboxes of senior U.S. government officials. An independent board of cyber experts tasked with investigating the email breach wrote in their report, published last week, that the hackers succeeded because of a “cascade of security failures at Microsoft.”

In March, Microsoft said that it continues to counter an ongoing cyberattack that allowed Russian state-backed hackers to steal portions of the company’s source code and internal emails from Microsoft corporate executives.

Updated with comment from Microsoft.

Microsoft reveals how hackers stole its email signing key… kind of


Software Development in Sri Lanka

Back
WhatsApp
Messenger
Viber