Neon Goes Dark After Exposing Users' Phone Numbers, Call Recordings, Transcripts (techcrunch.com) 29
An anonymous reader quotes a report from TechCrunch: A viral app called Neon, which offers to record your phone calls and pay you for the audio so it can sell that data to AI companies, has rapidly risen to the ranks of the top-five free iPhone apps since its launch last week. The app already has thousands of users and was downloaded 75,000 times yesterday alone, according to app intelligence provider Appfigures. Neon pitches itself as a way for users to make by providing call recordings that help train, improve, and test AI models. But now Neon has gone offline, at least for now, after a security flaw allowed anyone to access the phone numbers, call recordings, and transcripts of any other user, TechCrunch can now report.
TechCrunch discovered the security flaw during a short test of the app on Thursday. We alerted the app's founder, Alex Kiam (who previously did not respond to a request for comment about the app), to the flaw soon after our discovery. Kiam told TechCrunch later Thursday that he took down the app's servers and began notifying users about pausing the app, but fell short of informing his users about the security lapse. The Neon app stopped functioning soon after we contacted Kiam. TechCrunch found that the app's backend services didn't properly restrict access, allowing any logged-in user to request and receive data belong to other users. This included call transcripts, raw call recordings, and sensitive metadata, including phone numbers, the date/time of calls, and their durations.
TechCrunch discovered the security flaw during a short test of the app on Thursday. We alerted the app's founder, Alex Kiam (who previously did not respond to a request for comment about the app), to the flaw soon after our discovery. Kiam told TechCrunch later Thursday that he took down the app's servers and began notifying users about pausing the app, but fell short of informing his users about the security lapse. The Neon app stopped functioning soon after we contacted Kiam. TechCrunch found that the app's backend services didn't properly restrict access, allowing any logged-in user to request and receive data belong to other users. This included call transcripts, raw call recordings, and sensitive metadata, including phone numbers, the date/time of calls, and their durations.
That was entirely predictable (Score:5, Interesting)
I'm unclear on why they bothered to pull it down, unless the problem is people could snarf the data without paying for it.
Re: (Score:3)
You're probably right. The app makes no money if the owners can't sell the data because it's already leaked.
Re:That was entirely predictable (Score:5, Interesting)
Were any of the users actually paid what they were promised?
Were any users paid anything?
Re: (Score:1)
Re: (Score:1)
Re: That was entirely predictable (Score:1)
An MBA from Stanford and masters in economics from Oxford, yet not smart enough to hire the right people.
Re: (Score:2)
not smart enough to hire the right people.
If you don't know how to do X, then how do you know who are "the right people" to do X?
Re: That was entirely predictable (Score:3)
Re: (Score:1)
At the college level, academic fraud (read: cheating) has been rampant for decades, if you could afford it. It's actually more common at elite universities as the populations of those schools have more access to resources (read: money) to do cheating. Further, there are academically rigorous degrees and then there are cultural reproduction degrees. Athletes tend to get shunted into communication and geology (frequently referred to as "Rocks for jocks") that don't require much effort so they can keep doing t
Re: That was entirely predictable (Score:1)
W was actually really smart. https://www.keithhennessey.com... [keithhennessey.com]
Which makes him and the Bush family even more diabolical.
Re: That was entirely predictable (Score:2)
Re: (Score:2)
I refer you back to my premise that MBA and Economics graduates aren't actually that smart and the courses aren't all that academically rigorous. Your average Humanities major has a much more difficult academic career than your average economist. "Smart for a MBA student," is damning with faint praise.
Re: (Score:2)
Interesting article. Counterpoint: Any random 15-minute clip of him speaking in public. Alternate counterpoint: His two terms as president. Further counterpoint: His one and a quarter terms as governor of Texas.
*snarf (Score:1)
alternate meanings
1) (noun) a lovable yet slightly annoying character from the Thundercats show, who often uses his own name in his sentences
2) (adj.) sexy and/or stylish
oldie but goodie (Score:3)
TechCrunch found that the app's backend services didn't properly restrict access, allowing any logged-in user to request and receive data belong to other users.
I *loooove* how common this flaw is. I remember decades back getting hired by a guy to keep working on some event marketing website he'd had another programmer build. Took me like 10 minutes at that job to figure out you could do the exact same thing.
Re: (Score:3)
It is a classical sign of somebody that does not understand IT security at all. Whoever messed this up was only concerned to get it to work and never even though about how it could be misused. That you even have to log-in is probably only there because it is a ritual "you do".
Re: (Score:2)
It's an OWASP top 10
Oh Christ (Score:2)
This is just so delicious I cannot stop laughing at it.
Consent of who you were speaking to ? (Score:3)
Did neon insist that you got consent of the person that you were speaking to before the conversation was uploaded to neon ? I suspect not, so a huge privacy breach. I think illegal in Europe under the GDPR, I do not know about the USA which seems to be a wild west as far as data protection is concerned.
Re: (Score:2)
They say they only record YOUR mic, not the conversation. Of course there will be leakage of what the other person says through the speaker and your microphone, but it should be relatively easy to identify and filter out this signal, so at least in principle they can claim compliance with data privacy laws.
Well, they succeeded! (Score:2)
Where are the Apple apologists? (Score:2)
Prompt (Score:3)
That was a really short turn around! Most crypto or "AI" apps show themselves to be ill conceived and dangerous to users and society. But Neon really did a speedrun of it! I guess that's because it's both an "AI" and a crypto app.
And there was another article about Neon on here.. (Score:3)
Re: (Score:2)
Missing joke (Score:2)
The obligatory joke I was looking for involved the intelligence of people who would knowingly install such an app. Sell their souls for a wooden shekel?