900 Million Secrets From 8 Years of 'Whisper' App Were Left Exposed Online (washingtonpost.com) 32
Long-time Slashdot reader AmiMoJo shares a startling report from the Washington Post:
Whisper, the secret-sharing app that called itself the "safest place on the Internet," left years of users' most intimate confessions exposed on the Web tied to their age, location and other details, raising alarm among cybersecurity researchers that users could have been unmasked or blackmailed.
The data exposure, discovered by independent researchers and shown to The Washington Post, allowed anyone to access all of the location data and other information tied to anonymous "whispers" posted to the popular social app, which has claimed hundreds of millions of users. The records were viewable on a non-password-protected database open to the public Web. A Post reporter was able to freely browse and search through the records, many of which involved children: A search of users who had listed their age as 15 returned 1.3 million results.
The cybersecurity consultants Matthew Porter and Dan Ehrlich, who lead the advisory group Twelve Security, said they were able to access nearly 900 million user records from the app's release in 2012 to the present day. The researchers alerted federal law-enforcement officials and the company to the exposure.
Shortly after researchers and The Post contacted the company on Monday, access to the data was removed.
The data exposure, discovered by independent researchers and shown to The Washington Post, allowed anyone to access all of the location data and other information tied to anonymous "whispers" posted to the popular social app, which has claimed hundreds of millions of users. The records were viewable on a non-password-protected database open to the public Web. A Post reporter was able to freely browse and search through the records, many of which involved children: A search of users who had listed their age as 15 returned 1.3 million results.
The cybersecurity consultants Matthew Porter and Dan Ehrlich, who lead the advisory group Twelve Security, said they were able to access nearly 900 million user records from the app's release in 2012 to the present day. The researchers alerted federal law-enforcement officials and the company to the exposure.
Shortly after researchers and The Post contacted the company on Monday, access to the data was removed.
Wow! (Score:4, Funny)
Almost comparable to the effect, when finally the catholic database of worldwide confessions with photos, names and addresses will go online next week.
Re: (Score:2)
Protestantism: No priest confessions since the 16'th century.
You just have to consider God having your secrets, and he has much better security.
access to the data was removed (Score:2)
Details (Score:2)
Anyone heard any details of what the mistake was? I even *gasp* read TFA and didn't see any. So often these stories are "Amazon S3 buckets with world-readable access", because that was the default for so long. But Amazon finally fixed that a couple years back IIRC, so I'm curious now how idiots are managing to expose their company's entire data set online these days. What's the new "don't be that guy"?
Re: Details (Score:1)
TFA doesn't say; but usually it's an Elasticsearch instance.
Careless Whisper (Score:3)
George Michael was right.
Re: Careless Whisper (Score:1)
Re: (Score:2)
Ouch... now I have to go bleach my brain.
Consequences (Score:3, Insightful)
Comment removed (Score:4, Insightful)
Re: (Score:1)
Irrelevant. They said it was safe, sold the service on that basis. It wasn't, they lied, that's fraud.
If it's not safe don't claim it is.
Re: (Score:2)
Re: (Score:3)
Re: (Score:1)
At least one moderator does not understand the law. If you claim something is safe and it turns out not to be then it creates legal liability and you are opened up to lawsuits to redress your error or lies.
Re: (Score:3)
Re: (Score:1)
That would be a massive failure of technology. If we can't even use the internet to communicate privately we have screwed up massively.
Fortunately we can and regularly do. Accessing your bank's web site is generally secure, despite you having "put your banking details online". Communicating with Signal and even WhatsApp is secure due to end to end encryption, despite your private communications being "online".
Don't believe me? The cops would like a word with you, they have been wasting their time trying to
Re: (Score:1)
That would be a massive failure of technology. If we can't even use the internet to communicate privately we have screwed up massively.
Except the internet wasn't designed for privacy. And he daily breaches would seem to agree with that.
The concept of people divulging embarrassing, or criminal confessions onto a database seems a whole lot like something set up by law enforcement to aid in parallel construction, that I wonder if that might have been Whisper's true purpose. Not likely anyone would care about somoene screwinf the next door neighbor's spouse, but if someone confessed to a murder, you can bet they could be found - the resour
Re: (Score:2)
Why ever would the government want to protect that data? They're one of the main customers! They don't have to care about silly rules and laws when a third party gathered the data for them and they just have to pay for it.
end-to-end encryption? (Score:2)
so I have to assume Whisper didn't have end-to-end encryption, and the "private text" was being sent to the server and to the recipient in plain-text? (or maybe it was encrypted, but using a static key that was present on all of the installations?)
Or they used some weak encryption that was easy to break for the entire encrypted message database?
Or was this a case of back door abuse? Like end-to-end encryption that has a govt backdoor so they can give the key to countries that insist on having it before all
Re: (Score:2)
Perhaps “web scale” MongoDB has struck again...
Re: (Score:2)
It's almost always the cloud-based data store was left world-readable an unencrypted. For about a decade, every story like this turned out to be world-readable S3 buckets. A couple years back, Amazon finally changed the default on S3 to something sane, so we have to find a new form of idiocy. Still wondering what new folly these guys found.
Re: (Score:1)
Peak stupid! (Score:4, Interesting)
OK, we have a new low. People thought it was a good idea to take a "secret" that would have significant real-world repercussions if known - and to *post it to the internet* . Not only that, they did it after posting their own personal identifying data?! The mind boggles.
Start of the post is wrong (Score:1)
Long-time Slashdot reader AmiMoJo
It should start with this:
Long-time Slashdot idiot AmiMoJo
Re: (Score:1)
Fascinating (Score:3)
It should be interesting reading through this database. What a window into people's most intimate secrets.
Later....
God people are boring.
obvious honeypot (Score:1)
Whisper was an obvious honeypot. Surely no one on Slashdot is surprised that they kept a cleartext database of their users' "secrets"?
Re: (Score:1)
Whisper was an obvious honeypot. Surely no one on Slashdot is surprised that they kept a cleartext database of their users' "secrets"?
Actually a fishing expedition, but you are spot on about the purpose. They kept location data and if someone posted something juicy enough for law enforcement, they would use it, probably for parallel construction. But when you know the perp, you have a great place to build a case.
It can always get worse (Score:2)
That is the "nice" thing about the human race: Just when you think that somebody has fucked up in a truly unsurpassable way, somebody else fucks up worse. And, again, a halfway competent external pen-test would have found this. Arrogance and stupidity in the usual fatal combination.