1

I found a vulnerability in a paid Smartphone app. It is supposed to contain a lot of private details.

There is a logging option for support that you can switch off and on, to extract the part that causes you problems. The app's support can ask you to send them the log for review.

The problem is:

The app creates an email with a zip file and claims that it only contains logging information.

What it really does contain is the whole database, all private details you have ever entered. Neither the database, nor the zip file is encrypted. Plus the logging information.

A trusting customer would send the email, whose recipient is auto-added, and send his data unencrypted throughout the internet to the us-based company.

As the company implemented it that way, it is a bad idea to notify them.

Who should I notify for the company to not be alarmed and for the government to take appropriate action?

I am not US-based.

Improve this question
5
  • Don't everybody speak up at once! – Alex Mar 18 '20 at 14:38
  • Are you asking if including the entire database in the .zip file is illegal? Is the logging option on or off by default? Do the terms of service give notify the user that they will include information in the logging? – Brandin Mar 18 '20 at 15:21
  • " the government to take appropriate action": Which government? The US government? You've also tagged this gdpr, but that is a European law and not applicable in the US. – Nate Eldredge Mar 18 '20 at 15:51
  • @NateEldredge Which law is applicable in the US that refers to the issue. – Alex Mar 18 '20 at 16:35
  • @Alex: I don't know. I'm not sure that there is one. – Nate Eldredge Mar 18 '20 at 19:11
-1

You should notify it to Google or Apple. The application is clearly spying on customers.

The owner of the application said "we only collect X information" but instead, the application is collecting X + Y. then it breaches the contract.

Improve this answer
1
  • It's in Google's Playstore. I did and they did nothing. Neither did they reply, nor is the app banned. – Alex Mar 20 '20 at 0:09
1

As the company implemented it that way, it is a bad idea to notify them.

First and foremost, you notify the company of a security issue - you give them a reasonable amount of time to resolve it, and then you publish it. The management may know nothing about how the data is handled, and may rush to fix it when notified - you cannot make an assumption that everyone in the organisation is fully in the know and has given permission for the app to work in that way.

This may be something as simple as a dev leaving extra data in the report for debugging purposes that should have been removed before final release.

If you are an EU country or the UK, you can contact someone like the Information Commissioners Office and lodge a complaint.

If I were you, I’d ask the advice of someone who regularly handles data protection breaches about your next steps - perhaps reach out to Troy Hunt, who runs the Have I Been Pwned website and deals with disclosure daily.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.