GO SMS Pro Vulnerable to Media File Theft
The GO SMS Pro application is a popular messenger app with over 100 million downloads and was discovered to publicly expose media transferred between users of the app. This exposure includes private voice messages, video messages, and photos. This means any sensitive media shared between users of this messenger app is at risk of being compromised by an unauthenticated attacker or curious user.
Josh Bohls, Founder, Inkscreen
“Here is another example where a mobile app user believes their photos and videos are protected and only accessible by intended recipients, while in reality they are left exposed. This false sense of security can be exploited both on personal accounts, and in the enterprise. Companies who do not provide secure managed solutions for employees to capture and share multimedia content will find themselves similarly exposed to liability and loss.”
Erich Kron, Security Awareness Advocate, KnowBe4
“This is an example of the dangers of trusting third-party apps and a lesson in how not to respond to reported security issues. This vendor uses no authentication to ensure that only the intended recipients can receive the multimedia files. Instead, by using only a short, generated hex number to retrieve the file, they leave a huge number of people vulnerable to having private photos and data pilfered without their knowledge. More concerning is the thought that users may not even be aware of how to, or even have the ability to, delete these files once stored on the application developers’ servers.
Having notified the vendor over the course of three months, the security researchers followed a reasonable notification attempt before publicly disclosing the vulnerability. This is a tough call for researchers, especially when sensitive information is at risk, however, leaving the vulnerability in place and not informing potential users is also not acceptable.
As more and more applications are available for mobile devices, this threat will continue to grow. Consumers should be aware that just because a lot of others are using the service, doesn’t mean that the service is secure or safe to use.”