Justdial patches security flaw that exposed sensitive data of over 156 million accounts

In the world of constant data leaks and breaches, you can now add one more company to the list. A critical security flaw was found on Justdial, which could enable attackers to access sensitive account information of 156.1 million users on the platform. Justdial has now patched the flaw but we suggest you change your account password right away, in case you use the platform. The issue reportedly stemmed from Justdial’s Register API that would enable an attacker to get access into any Justdial account by using a phone number in the username parameter. The flaw was reported by the security researcher Ehraz Ahmed, via MoneyControl.

As per the report, the Register API vulnerability could enable hackers to access anyone’s Justdial account. This would be done by replacing the phone number under the username parameter so that the system returns an access token, system ID (SID) and user ID (UID). The SID would then be used to access the account and another accounts linked to it while the UID enabled posting on the user’s Justdial Social Profile. The worrying bit is that accessing a Justdial account also gives access to the Justdial Pay account and its settings can be changed to redirect funds to another bank account. However, transferring existing funds to another account is not possible since an account or UPI pin is required to confirm the transaction. 

The security researcher also mentions that hackers and telemarketers can mine Justdial data by using a script and phone number dumps found online. You can see how Ahmed exploited the flaw to gain access to a Justdial account from the video above. As mentioned above, Justdial patched the flaw and sent out a statement to the media that reads, “We at Justdial take security seriously. There was a bug in one of our API which could potentially be accessed by an expert hacker. This bug has been fixed. We work with various security researchers to strengthen our platform and would like to thank Ehraz Ahmed for bringing this out to us.”

from Latest Technology News https://ift.tt/2VvgSkt