Over 100 Million JustDial Users' Personal Data Found Exposed On the Internet

guest · Apr 17, 2019

Over 100 Million JustDial Users' Personal Data Found Exposed On the Internet
April 16, 2019
https://thehackernews.com/2019/04/justdial-hacked-data-breach.html

An unprotected database belonging to JustDial, India's largest local search service, is leaking personally identifiable information of its every customer in real-time who accessed the service via its website, mobile app, or even by calling on its fancy "88888 88888" customer care number, The Hacker News has learned and independently verified.

Rajshekhar Rajaharia, an independent security researcher, yesterday contacted The Hacker News and shared details of how an unprotected, publicly accessible API endpoint of JustDial's database can be accessed by anyone to view profile information of over 100 million users associated with their mobile numbers.

Though the unprotected APIs exist since at least mid-2015, it's not clear if anyone has misused it to gather personal information on JustDial users.
Rajshekhar told The Hacker News that he discovered this unprotected end-point while pentesting the latest APIs in use, which are apparently protected and using authentication measures.
Click to expand...

guest · Apr 30, 2019

Second loophole:
Justdial Scrambles To Plug Multiple Leaks As Reviewer Data Goes Public
April 30, 2019
https://inc42.com/buzz/justdial-database-leak-reviewer-data/

Earlier this month, an independent security researcher Rajshekhar Rajaharia, discovered a major security loophole in the Indian hyperlocal search engine Justdial’s database.
However, the researcher had again discovered a loophole (on April 29) in the company’s APIs which exposed the reviewer’s database of the company. The second loophole was fixed on the same day of researcher’s report, Rajaharia told Inc42.

“The API connected to Justdial’s database of reviewer’s has been unprotected since the company’s foundation. This loophole means that reviewer’s name, mobile number, and location were publicly available on the internet,” Rajaharia told Inc42.
In response to an Inc42 query, a Justdial said that its team had contacted Rajaharia and had fixed the issue which had caused the data breach.
Click to expand...

guest · Oct 10, 2019

A bug in Indian local search app exposed over 156 million accounts
October 10, 2019
https://thenextweb.com/security/201...search-app-exposed-over-156-million-accounts/

A major flaw in an Indian local search app, Justdial, allowed hackers to log in to any of its 156 million users accounts.

First reported by MoneyControl, the bug was discovered by security researcher Ehraz Ahmed last month. It exploited the site’s Register API used for sign-ups.
The bug allowed hackers to even change account details for JD Pay so all the money sent to that account gets redirected. However, it didn’t allow them to send money as it requires an additional PIN.
JustDial said in a statement the flaw was fixed yesterday:

We at Justdial take security seriously. There was a bug in one of our APIs which could potentially be accessed by an expert hacker. This bug has been fixed. We work with various security researchers to strengthen our platform and would like to thank Ehraz Ahmed for bringing this out to us.
The company said there was no loss of data.
Click to expand...

guest · Jul 30, 2021

Justdial leaks personal data of 100 million users... Again
July 27, 2021
https://www.securitynewspaper.com/2...aks-personal-data-of-100-million-users-again/

A recent report states that Justdial, one of the largest service companies in India, has suffered a data breach that led to the exposure of confidential records of more than 100 million users. According to researcher Rajshekhar Rajaharia, the information remained exposed since March 2020.

The leak consists of records of users’ personal information, including usernames, email addresses, phone numbers and dates of birth. This incident appears to be related to a flaw detected in 2019 by Justdial’s teams and which was apparently not properly addressed.
As in other similar incidents, the detection of the unprotected database does not mean that the threat actors have accessed the exposed information; however, it does imply the risk that this information will eventually be used to deploy massive phishing campaigns.
Click to expand...

At the time, threat actors claimed to have extracted nearly 13 TB of confidential information held by Domino’s India. These confidential records included names, email addresses, phone numbers and location details.
Click to expand...

Log in or Sign up

Over 100 Million JustDial Users' Personal Data Found Exposed On the Internet

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Over 100 Million JustDial Users' Personal Data Found Exposed On the Internet

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches