Android messaging app exposed millions of private photos and files

guest · Nov 20, 2020

One of the most popular Android messaging apps just exposed millions of private photos and files
November 19, 2020
https://www.komando.com/security-privacy/go-sms-pro-data-leak/765166/

A new data leak affects more than 100 million people who installed one of the most popular messaging apps around. Anyone who exchanged files on the app may have accidentally exposed their private data without knowing it.

GO SMS Pro is one of Android’s most popular messaging apps — with more than 100 million installations according to its Google Play listing.
Researchers at Trustwave recently discovered a security flaw that allowed photos and files exchanged on GO SMS Pro to be publicly exposed.
Click to expand...

In a new report, the researchers outlined the flaw and informed the app’s developer of their findings. When a user sends a file to someone without the app installed, the app uploads the file to its servers and shares a web address for the recipient to click on. Unfortunately, the web addresses shared by the app were numbered sequentially and easy to predict.

Trustwave shared its findings with TechCrunch, which tested and confirmed the flaws themselves. They were able to view private images like a screenshot with bank information, an order confirmation with a home address and an arrest record.
Click to expand...

Unfortunately, there isn’t a fix that can protect files that have already been sent. We’d recommend that any active GO SMS Pro users stop using the app to send sensitive media files. In other words, act as if anything you send on the app is public.
Click to expand...

Trustwave: GO SMS Pro Vulnerable to Media File Theft

This weakness was discovered on GO SMS Pro v7.91. It is unclear which other versions are affected but we believe this is likely to affect previous and potentially future versions as well.

SpiderLabs found that accessing the link was possible without any authentication or authorisation, meaning that any user with the link is able to view the content. In addition, the URL link was sequential (hexadecimal) and predictable.
Click to expand...

guest · Dec 1, 2020

Android app still exposing messages of 100M users despite bug fix
December 1, 2020
https://www.bleepingcomputer.com/ne...osing-messages-of-100m-users-despite-bug-fix/

GO SMS Pro, an Android instant messaging app with more than 100 million installs, is still exposing the privately shared messages of millions of users even though the developer has been working on a fix for the flaw behind the data leak for almost two weeks.

The flaw, discovered by Trustwave researchers three months ago and publicly disclosed on November 19, enabled unauthenticated attackers to gain unrestricted access to voice messages, videos, and photos privately shared by GO SMS Pro users.
Click to expand...

As the researchers found and BleepingComputer was able to verify, the shared files include photos of users' cars, screenshots of other private messages and Facebook posts, videos and audio recordings, photos of sensitive documents, and even nude photos.

"By taking the generated URLs and pasting them into the multi-tab extension on Chrome or Firefox, it is trivial to access private (and potentially sensitive) media files sent by users of this application," the researchers explained.
New versions didn't fix the data leak problem
"A new version of the app was uploaded to the Play Store the day before we released our advisory and Google then removed the app from the Play Store sometime on Friday, November 20th, the day after we released our advisory," the researchers said today in a report shared with BleepingComputer earlier this week.
Click to expand...

Trustwave: GO SMS Pro Vulnerable to File Theft: Part 2

Last week we released an advisory about an SMS app called GO SMS Pro. Media files sent via text in the app are stored insecurely on a publicly accessible server. With some very minor scripting, it is trivial to throw a wide net around that content.

It seems like GOMO is attempting to fix the issue, but a complete fix is still not available in the app. For v7.93, it appears that they disabled the ability to send media files completely.
[...] Despite these half fixes, we can confirm that older media used to verify the original vulnerability is still available.
Click to expand...

Log in or Sign up

Android messaging app exposed millions of private photos and files

guest Guest

guest Guest

Log in or Sign up

Android messaging app exposed millions of private photos and files

guest Guest

guest Guest

Useful Searches