Over 100 Million JustDial Users' Personal Data Found Exposed On the Internet: Report

Moneylife Digital Team 17 April 2019

An unprotected database belonging to JustDial, India's largest local search service, is leaking personally identifiable information of its every customer in real-time, who accessed the service via its website, mobile app, or even by calling on its 88888 88888 customer care number, says a report.

The report from The Hacker News, says, the leaked data includes JustDial users' name, email, mobile number, address, gender, date of birth, photo, occupation, company name they are working with—basically whatever profile related information a customer ever provided to the company.

The report says, Rajshekhar Rajaharia, an independent security researcher, contacted The Hacker News and shared details of how an unprotected, publicly accessible application programming interface (API) endpoint of JustDial's database can be accessed by anyone to view profile information of over 100 million users associated with their mobile numbers.

After verifying the leaky endpoint, The Hacker News says it verified and found the API is fetching results directly from the production server or from a backup database that might not have information belonging to recently signed-up users.

This includes people who had called the customer care number of JustDial as well, the report says.

Although the unprotected API is connected to the primary JD database, Mr Rajshekhar told the portal that it is an old API endpoint, which is not currently being used by the company but left forgotten on the server.

Mr Rajshekhar says he discovered this unprotected end-point while testing the latest APIs in use, which are apparently protected and using authentication measures. Besides this, Mr Rajshekhar also found a few other old unprotected APIs, one of which could allow anyone to trigger one time passcode (OTP) request for any registered phone number, which might not be a serious security issue, but could be used for spamming users and costing the company, the report says.

Comments