Droom Fixes Security Flaw That Exposed Private Data, Banking Details of Millions

guest · Dec 11, 2019

Droom Fixes Security Flaw That Exposed Private Data, Banking Details of Millions
The security flaw in Droom’s system was associated with misconfiguration of the Facebook sign-in API
December 10, 2019
https://gadgets.ndtv.com/internet/n...l-phone-number-bank-aadhaar-pan-fixed-2146420

Droom, one of India's largest online marketplaces for buying and selling vehicles, has fixed a severe security flaw that was exposing the personal data and banking details of millions of its users.

Independent security researcher, Sayaan Alam, reached out to Gadgets 360 with his findings of the aforesaid security flaw in Droom's system, and also shared with us the PoC of how hackers could exploit the bug to gain access to user data.
All these details such as user name, address, phone number, Aadhaar number, PAN card number, bank account number, purchase history, and more were pulled out in a very short span of time by Alam after exploiting the flaw.

“The issue lay with misconfiguring of Facebook sign-in API. Facebook's authentication gives a site a unique token, which is used to confirm your sign-in details. But due to a misconfiguration, attacker can change their email ID to victim's email ID and this gives him access to other user's account,” Alam told Gadgets 360.
Click to expand...

We have reached out to the company for more details about the flaw and whether any user data was compromised. We will update this copy when we hear back from Droom.
As for the company, it has a userbase of 35 million users monthly users. Apart from India, the company has a presence in Malaysia, Singapore, and Thailand as well.
Click to expand...

Log in or Sign up

Droom Fixes Security Flaw That Exposed Private Data, Banking Details of Millions

guest Guest

Log in or Sign up

Droom Fixes Security Flaw That Exposed Private Data, Banking Details of Millions

guest Guest

Useful Searches