Category: General|Nov 26, 2019 | Author: Admin

Vulnerability Hit Truecaller App Potentially Affecting Millions Of Users

Share on

The popular call-blocking application Truecaller has recently made it to the news due to a security flaw. A researcher discovered a serious vulnerability in the Truecaller app that could have threatened the security of millions of users.

Truecaller App Vulnerability Indian security researcher Ehraz Ahmed found a critical vulnerability in the Truecaller app.

Specifically, the vulnerability allowed a user to plant a URL into the profile picture. Hence, a potential attacker could exploit the flaw to inject a malicious URL to the profile picture. As a result, anyone clicking on the profile would fall a victim to the attack. According to Forbes, Ahmed told,

The flaw allows an attacker to inject his malicious link as the profile URL. The user viewing the attacker’s profile by search or through a popup gets exploited.

The researcher revealed that such attacks could allow the attacker to extract numerous details about the user. This includes fetching the victim’s IP address, user-agent and time without them knowing. He has also shared a POC of the exploit demonstrating how an attacker could fetch victim’s information.

Patch Now After finding the bug, the researcher swiftly informed Truecaller about the matter before going public. Consequently, Truecaller patched the flaw in the app’s API and has released the fix. As per their statement to Forbes,

It was recently brought to our attention that there was a small bug in our app services which allowed the modification of one’s own profile in an unintended way. We thank the security researcher for bringing this to our notice and collaborating with us. The bug was immediately fixed.

Since it’s a critical bug affecting all Truecaller applications, users must ensure they update their devices with the latest patched versions. Alongside the fix, Truecaller has also disclosed its plans to announce a bug bounty program soon. Let us know your thoughts in the comments.

Sponsored Ads:

Comments:


Apple sidles into sideloading in the EU

Category: Apple|Apr 21, 2024 | Author: Admin

Report: Microsoft-OpenAI ownership might get conditional OK from EU regulators

Category: IT|Apr 20, 2024 | Author: Admin

Giant change at Google could change everything

Category: Google|Apr 19, 2024 | Author: Admin

Now Windows will be bothered about this too

Category: Microsoft|Apr 18, 2024 | Author: Admin

Test the new AI trick with Logitech

Category: IT|Apr 17, 2024 | Author: Admin

The US Government Has a Microsoft Problem

Category: Microsoft|Apr 16, 2024 | Author: Admin

Now comes the commercial

Category: Microsoft|Apr 15, 2024 | Author: Admin

Linux Foundation is leading fight against fauxpen source

Category: IT|Apr 14, 2024 | Author: Admin

3000 news articles!!! Happy reading!

Category: General|Apr 13, 2024 | Author: Admin

Google shuts down new product

Category: IT|Apr 12, 2024 | Author: Admin

YouTube CEO warns OpenAI that training models on its videos is against the rules

Category: IT|Apr 11, 2024 | Author: Admin

Google unveils Arm-based data center processor, new AI chip

Category: Google|Apr 10, 2024 | Author: Admin

Microsoft to invest $2.9 bln to expand AI, cloud infra in Japan

Category: Microsoft|Apr 9, 2024 | Author: Admin

Nintendo shuts off online access for 3DS and Wii U today

Category: IT|Apr 8, 2024 | Author: Admin

Musk challenges Brazil's order to block certain X accounts

Category: IT|Apr 7, 2024 | Author: Admin
more