A critical security lapse has come to light after researchers uncovered that nearly 1.5 million explicit images from specialized dating apps were stored online without any password protection. This vulnerability, affecting apps such as BDSM People and Chica, poses severe risks for the estimated 800,000 to 900,000 individuals who use these services.
The issue was initially flagged to M.A.D Mobile, the parent company of these platforms, on January 20, yet no remedial measures were taken until prompted by the BBC on Friday. Following media inquiry, the company acted promptly to rectify the flaw, though they did not elaborate on the reasons behind the negligence or the specifics of the breach.
This alarming discovery was made by ethical hacker Aras Nazarovas from Cybernews, who managed to access the sensitive content uncovered in unencrypted online storage. Nazarovas expressed shock at the ease of access to private photos, which even included images removed by moderators and private messages shared between users.
The implications of such a data breach are profound; malicious hackers could exploit these views for extortion, particularly threatening users in countries where LGBT individuals face hostility. The unprotected images lacked identifying metadata, which would complicate targeted attacks, although the risks still loom large.
In a statement, M.A.D Mobile acknowledged the vulnerability and credited Nazarovas for exposing it. They affirmed that an update would be released to secure the apps imminently but did not address further questions regarding the company's operations or the reasons for their delayed response to the warnings.
In light of similar incidents in the past, like the data breach of Ashley Madison, cybersecurity experts underscore the importance of swift action in addressing vulnerabilities to shield users from potential risks. Nazarovas decided to publicize the breach while it was still active, expressing that the urgency to protect users outweighed the usual protocol of waiting for fixes before issuing reports.
