Bug hits Truecaller app threatening the security of millions of users


By MYBRANDBOOK


Bug hits Truecaller app threatening the security of millions of users

A serious vulnerability was discovered in the popular call-blocking application Truecaller that could have threatened the security of millions of users.

 

It was found out by Indian security researcher Ehraz Ahmed. According to the discovery, the vulnerability allowed a user to plant a URL into the profile picture. Hence, a potential attacker could exploit the flaw to inject a malicious URL to the profile picture. As a result, anyone clicking on the profile would fall victim to the attack.

 

The researcher further revealed that such attacks could allow the attacker to extract numerous details about the user. This includes fetching the victim’s IP address, user-agent and time without them knowing.

 

He has also shared a POC of the exploit demonstrating how an attacker could fetch victim’s information.

 

After having discovered the bug, Truecaller was informed about the matter before going public. Consequently, Truecaller patched the flaw in the app’s API and has released the fix.

 

“It was recently brought to our attention that there was a small bug in our app services which allowed the modification of one’s own profile in an unintended way. We thank the security researcher for bringing this to our notice and collaborating with us. The bug was immediately fixed. Since it’s a critical bug affecting all Truecaller applications, users must ensure they update their devices with the latest patched versions,” said Truecaller in one of its statements.

 

Truecaller has also disclosed its plans to announce a bug bounty program soon.

 E-Magazine 
 VIDEOS  Placeholder image

Copyright www.mybrandbook.co.in @1999-2024 - All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of Kalinga Digital Media Pvt. Ltd. is prohibited.
Other Initiatives : www.varindia.com | www.spoindia.org