Skip to main content

Sarahah app exposed for quietly uploading users' contacts to company servers without proper permissions


The anonymous messaging app Sarahah has been uploading your phone’s contacts to the company’s servers without your knowledge or permission. The security loophole was first discovered by analyst Zachary Julian and The Intercept was the first publication to report the same. The harvesting of a user's contacts is a big setback for users of the Sarahah app and opens them up to multiple security risks. Sarahah's privacy policy states that it will not sell user data to third parties unless it is part of bulk data used for statistics and research.

The Sarahah app has recorded millions of downloads on the Google Play Store and the Apple App Store combined. According to Julian, the app that plays on getting users “honest feedback” from their friends, quietly harvests and uploads its user’s phone contacts to the company’s servers.These include all phone numbers and email addresses stored in your device’s address books.

While Sarahah does ask for permission to access a user’s contacts, it does not specify that the same are being uploaded and stored on its servers. Julian, a senior security analyst at Bishop Fox, installed the Sarahah app on a Galaxy S5 running Android 5.1.1. The device was running a security monitoring software called BURP Suite, which allowed him to see data from his phone being sent to remote servers. On installing and running Sarahah, Julian discovered that the app was sending his personal contacts data to the company’s servers without proper permissions.

The transfer of user contacts and emails to the Sarahah servers is not limited
to the Android OS and the same also occurs on iOS devices after the app procures permissions to “access contacts.” As per Julian’s testing the if users don’t access the Sarahah app for a few days, it pushes contacts data all over again when rebooted. When Julian tried rebooted the app after a gap on two days, all his contacts were pushed to the Sarahah servers again.

After this security flaw was discovered, Sarahah creator, Zain al-Abidin Tawfiq tweeted that the contact storing behaviour will be removed from the app in future updates and was put in place for a “find your friends feature.” He also told The Intercept that the feature was supposed to be removed by a partner who he has stopped working with, but the partner somehow “missed that.” Tawfiq went on to claim that the function of storing contacts was removed from the servers and that Sarahah servers no longer store any contacts, but his claim is unverified as security researchers cannot possibly know what happens at the server end of the app.

Twitter @ZainAlabdin878
“The privacy policy specifically states that if it plans to use your data, it’ll ask for your consent,” said Julian. While the app does specify it will access contacts, as per Julian, it is not “enough consent” to justify “sending all of those contacts over without any kind of specific notification.” On iOS, while the app claims it will show you who in your address book is using the Sarahah app, it does not do so.

“Sarahah has between 10 and 50 million installs on just the Play Store alone for Android, so if you extrapolate that number, it could easily get into hundreds of millions of phone numbers and email addresses that they’ve harvested,” Julian said.

You can view some of Julian’s tests of the Sarahah app in the video below

click Here: https://vimeo.com/231153024

Comments

Post a Comment

Advertisement

Popular posts from this blog

YouTube gets a new identity with updated logo and improved design

For the first time ever, YouTube has changed its logo and done away with its “Tube-in-a-tube” design. Both the YouTube website and the app have adopted a new material design and added some new features. After almost 12 years and for the first time ever, YouTube has a new identity in the form of an updated logo. The new logo also serves as YouTube’s app icon and can be seen in on the website as well. The previous YouTube logo displayed a “tube-in-a-tube” design in which the red patch covered the second half of the logo. The new design sports a much brighter red color and the play button sits on the left of the brand name. The video streaming service itself has undergone a design overhaul with new color schemes, typeface, and a bunch of major changes to the look, feel, and functionality of its desktop and mobile app. The mobile app now sports a much cleaner design with gestures such as double tapping on the left or right side of a video in order to forward or rewind it by t...
Post a Comment
Read more

Apple Confirms 12 September Launch Event, Will It Be the iPhone 8?

Apple’s next big event is slated to take place on 12 September. The Cupertino-  based giant has started sending out invites to the media across the world,  stating, Let’s meet at our place. The event is set to take place for the first time at the Steve Jobs Theater in  Cupertino, marking the 10th anniversary of the first iPhone which was  unveiled by Jobs. While the invite doesn’t confirm the products to be announced at the event,  but it wouldn’t hard to see beyond the latest series iPhone, which could either  be the iPhone 7S or the much anticipated, iPhone 8. But, going by the usual pattern with Apple, September announcements are  usually based around its flagship smartphone. There has been a lot of speculation as to whether, Apple will finally come out  with a new design language for the iPhone this year. Many rumours have suggested, the supposed iPhone 8 will carry a bezel-less  display, and misses out on th...
Post a Comment
Read more