A well-known IOS app for taking telephone languages should have made rough quantities of records for unauthorized persons. Reason was a programming error, reports the security researcher Anand Prakash of Pingsafe AI. The app called Call Recorder uses Amazon Web Services (AWS) to save the recordings.
Telephone number was interchangeable
With the help of the proxy tool Burp Suite, Prakash succeeded in analyzing the traffic of Call Recorder. He realized that it was trivial possible to exchange the phone number and send it to the Cloud Backend of Call Recorder. Then it was possible to access all the recordings of this person, which were deposited with AWS – just about the app itself. Authentication apparently did not take place because the app was familiar with blind.
130.000 recordings potentially suction
Potentially, up to 300 gigabytes of data were accessible if you go after the size of the affected bucket – with Uber 130.000 recordings, such as security researchers prakash the IT blog Techcrunch informed. There you could understand the behavior with a test iPhone.
Currently it is unclear whether the cheeks were exploited by third parties or prakash was the first user that they noticed. After notifying the developer of Call Recorder, the first recorded the AWS Bucket. Meanwhile, a new version of the app has been published. At this it is called in the leaflet, "A security report" Become with it "patched".
High in-app subscription price
Call recorder is popular. The software was downloaded according to your developer over a million times and should have been a top 20 business app in 20 countries. Due to the high in-app subscription price of 7.49 euros per week, however, there is also criticism, sometimes the app simply does not connect, it is also in user citizens.
Tools like this are used by users because iOS does not allow the recording of calls from privacy. Call recorder is therefore responsible for a separate mediation and connects them. Recordings without the approval of the talk partner can be punishable in Germany.