Unsecured Chinese companies leak users’ sensitive personal and business data

guest · Jul 1, 2020

Unsecured Chinese companies leak users’ sensitive personal and business data
June 30, 2020
https://cybernews.com/security/unse...k-users-sensitive-personal-and-business-data/

Our research uncovered two unsecured databases, with millions of records, belonging to companies that are based in China and provide different types of services. One database belongs to Xiaoxintong, which offers multiple apps and services aimed at elderly care. The other database we discovered seems to be connected to Shanghai Yanhua Smartech tools, which provides services related to intelligent buildings.

The database for Xiaoxintong, which serves more than 200 million elderly people in China, contains sensitive information such as GPS locations, mobile numbers, addresses, hashed passwords and more.

The second database that may be from Shanghai Yanhua Smartech has even more sensitive data, such as easily-decoded audio files, names, employee ID numbers, heart rates, oxygen levels, GPS locations and more. Both databases are now closed.
Click to expand...

The Xiaoxintong database
According to ITJuzi.com, Xiaxintong is an “intelligent elderly care service platform” that is composed of both an “intelligent mobile terminal and cloud service platform.” This service provides “mobile rescue, love and health services to the elderly for free.”

[...] Xiaoxintong serves 200 million elderly people living in China.
The Xiaoxintong database contains more than 340,000 records [...]
The second database (possibly from Shanghai Yanhua Smartech)
While we’re fairly confident that the first Chinese database belongs to Xiaoxintong, we haven’t fully confirmed that the second database belongs to Shanghai Yanhua Smartech.

The second database contains more than 4.2 million records [...]
Click to expand...

Disclosure
In order to get these databases taken offline, we attempted to contact the database owners immediately after we discovered them on January 14, 2020. However, we were unable to contact those owners. The Xiaoxintong database was closed soon after we notified them, but for the second database we had to go through CERT of China (CNCERT), which worked with us to eventually close the database on March 5, 2020.

We were unable to get any comment or information from the database owners.
Click to expand...

Log in or Sign up

Unsecured Chinese companies leak users’ sensitive personal and business data

guest Guest

Log in or Sign up

Unsecured Chinese companies leak users’ sensitive personal and business data

guest Guest

Useful Searches