Over a million private photos from dating apps exposed online – BBC.com

🔍 Summary:

Researchers have uncovered a significant security lapse involving nearly 1.5 million private photos from specialist dating apps, which were stored online without password protection. These images, many of which were explicit, were accessible to anyone with a direct link. The affected apps, developed by M.A.D Mobile, cater to niche interests and include BDSM People, Chica, Pink, Brish, and Translove, collectively used by up to 900,000 people.

The security flaw was initially reported to M.A.D Mobile on January 20 by ethical hacker Aras Nazarovas of Cybernews, who discovered the unprotected online storage by analyzing the apps’ code. Despite the early warning, the company only addressed the issue after the BBC contacted them several days later. The exposed photos included not only profile images but also private message exchanges and content previously deleted by moderators.

This breach posed a significant risk, particularly for users in countries hostile to LGBT individuals, as it could lead to extortion or other malicious activities. Although the images were not directly linked to user identities, the potential for targeted attacks remained a concern. M.A.D Mobile has since secured the photos and expressed gratitude towards Nazarovas for identifying the vulnerability, promising further updates to the apps. However, they have not disclosed the specifics of the breach’s origin or why it took so long to respond to the initial warnings.

📌 Source: https://www.bbc.com/news/articles/c05m5m5v327o