A security security in the Dating App Raw has publicly exposed the personal data and private data data of its users, TechCrunch found.
Exposed data included user display names, dates of birth, dating and sexual preferences associated with the RAW application, as well as users’ locations. Some of the location data included coordinates that were specific enough to identify RAW app users accurately at street level.
RAW, which started in 2023, is a dating application that claims to offer more genuine interactions with others in part by asking users to upload daily selfie photos. The company does not reveal how many users it has, but its application in the Google Play Store notes over 500,000 Android downloads to date.
The news for the safety delay comes in the same week that the start announced an extension of dating application material, The Raw Ring, An unconfirmed portable device He claims to allow applications to monitor their partner’s heart rate and other sensor data to receive knowledge produced by AI, seemingly detecting infidelity.
Despite the moral and moral issues of watching romantic partners and The dangers of emotional surveillanceRAW claims on its website and in the Privacy Policy that its implementation and its non-circulated device use end to end, a safety feature that prevents anyone other than the user-including the company-from accessing the data.
When we tried the app this week, which included an application network analysis, TechCrunch found no evidence that the application uses end to end. Instead, we have found that the application disseminates public data on its users to anyone with a web browser.
RAW determined the report on Wednesday, shortly after contacting TechCrunch with the company details.
“All previous exposed endpoints have been secured and we have implemented additional safeguards to prevent similar issues in the future,” Marina Anderson, co -founder of the App Dating App, told TechCrunch.
When asked by TechCrunch, Anderson confirmed that the company had not conducted a third -party security check, adding that “its focus remains to build a high quality product and to be involved in our developing community.”
Anderson will not be committed to actively notifying influenced users that their information was exposed, but said the company would “submit a detailed report to the competent data protection authorities under applicable regulations”.
It is not immediately known how long the application publicly diffuses its users’ data. Anderson said the company was still investigating the incident.
Concerning her claim that the application uses end to end, Anderson said that RAW “uses encryption in transit and imposes access controls for sensitive data on our infrastructure.
Anderson would not say when asked if the company plans to adjust its privacy policy and Anderson did not respond to an email from TechCrunch.
How did we find exposed data
TechCrunch discovered the error on Wednesday during a short application test. As part of our test, we installed the Raw Dating application on an Android virtual device, which allows us to use the application without having to provide real world data, such as our physical location.
We created a new virtual user account, such as a name and date of birth, and we designed the location of our virtual device to appear as if we were in a museum in Mountain View, California. When the app requested the location of our virtual device, we allowed access to the application to our exact location in a few meters.
We used a network analysis tool to monitor and inspect data flowing in and out of the RAW application, which allowed us to understand how the application works and what data of the application was uploaded for its users.
TechCrunch discovered exposure to data within minutes of using the RAW application. When we first loaded the application, we found that it was pulling the user profile information directly from the company’s servers, but that the server does not protect the data returned with any check -up certification.
In practice, this meant that one could have access to private information of any other user using a web browser to visit the tissue address of the exposed server – api.raw.app/users/ followed by a unique 11 -digit number corresponding to another application user. Changing the digits corresponding to the 11 -digit ID of the other user has returned private information from this user’s profile, including their location data.
This type of vulnerability is known as an insecure direct object or identifier, a type of error that can allow one to access or modify the data to someone else’s server due to a lack of appropriate security checks to the user accessing the data.
As we have previously explained, Idor errors are similar to having a key to a private mailbox, for example, but this key can also unlock any other mailbox on the same road. Therefore, IDOR errors can be easily exploited and in some cases are listed, allowing access to the registration after registering user data.
The US Cybersa Security Service has long been warned of the risks of IDOR errors, including the ability to access typically sensitive “scale” data. As part of Safe from design Initiative, Cisa said In a 2023 counseling That developers should ensure that their applications perform appropriate authentication and authorization controls.
Since RAW determined the error, the exposed server no longer returns user data to the browser.
