Gym app management platform exposed info of thousands of users

guest · Aug 18, 2020

Gym app management platform exposed info of thousands of users
August 18, 2020
https://www.bleepingcomputer.com/ne...-platform-exposed-info-of-thousands-of-users/

Hackers could hijack user accounts in dozens of fitness and gym mobile applications, even where the two-factor authentication (2FA) mechanism was active.

The common ground for all the apps is Fizikal, a management platform from Israel for gyms and sports clubs that allows customers to handle their subscription and class registration.
Several vulnerabilities affecting the Fizikal platform could be chained to bypass security checks, enumerate users, bruteforce the one-time password (OTP) for logging in, and get access to a user's account.
Easy brute force
Sahar Avitan, a consultant at Israel-based boutique cybersecurity firm Security Joes, discovered that about 80 apps relied on Fizikal's API to ensure easier access to the club and amenities available.
Click to expand...

Ido Naor, founder and CEO of Security Joes, told BleepingComputer that an ill-intended individual could have leveraged these vulnerabilities to learn the schedule of someone famous or a member of the government.
According to the researchers, Fizikal and the CERT in Israel received a full report about the findings and acted quickly to address the issues.
Click to expand...

Log in or Sign up

Gym app management platform exposed info of thousands of users

guest Guest

Log in or Sign up

Gym app management platform exposed info of thousands of users

guest Guest

Useful Searches