BreachExchange mailing list archives
India’s Jio Coronavirus symptom checker exposed test results
From: Destry Winant <destry () riskbasedsecurity com>
Date: Tue, 5 May 2020 09:18:10 -0500
https://securityaffairs.co/wordpress/102698/data-breach/coronavirus-symptom-checker-data-leak.html A security glitch in the self-test coronavirus symptom checker developed by India’s Jio cell network exposed test results. While Coronavirus was spreading worldwide, India’s largest cell network Jio, a subsidiary of Reliance, has developed a coronavirus self-test symptom checker, days before the Indian government imposed a local lockdown to prevent the outbreak. The app was developed to help users to simply check the COVID-19 symptoms. A security lapse in the symptom checker application exposed one of its databases online without a password, TechCrunch reported. The database was discovered by the security researcher Anurag Sen on May 1, immediately after it was first exposed. The researcher shared his discovery with TechCrunch and reported it to Jio. The cell network quickly took pulled the system offline, at the time it is not possible to determine if third-parties accessed the database. “We have taken immediate action,” said Jio spokesperson Tushar Pania. “The logging server was for monitoring performance of our website, intended for the limited purpose of people doing a self-check to see if they have any COVID-19 symptoms.” “The database contains millions of logs and records starting April 17 through to the time that the database was pulled offline. Although the server contained a running log of website errors and other system messages, it also ingested vast numbers of user-generated self-test data.” reads the post published by TechCrunch. “Each self-test was logged in the database and included a record of who took the test — such as “self” or a relative, their age, and their gender.“ The database also included user agent, the user’s browser version, the operating system along with data associated with each profile (answers to each question asked by the symptom checker, user’s precise location if allowed). “From one sample of data we obtained, we found thousands of users’ precise geolocation from across India.” reads the post published by TechCrunch. “TechCrunch was able to identify people’s homes using the latitude and longitude records found in the database.” Most of the location data is clustered around major cities, like Mumbai and Pune. TechCrunch also found users in the United Kingdom and North America. _______________________________________________ BreachExchange mailing list sponsored by Risk Based Security BreachExchange () lists riskbasedsecurity com If you wish to Edit your membership or Unsubscribe you can do so at the following link: https://lists.riskbasedsecurity.com/listinfo/breachexchange
Current thread:
- India’s Jio Coronavirus symptom checker exposed test results Destry Winant (May 05)