Hyundai Motor India sign

Hyundai Motor India fixes bug that exposed customers' personal data

by with No Comment Tech

Hyundai Motor India sign

Image Credits: Ashish Vaishnav/SOPA Images/LightRocket / Getty Images

Hyundai’s India subsidiary has fixed a bug that exposed its customers’ personal information in the South Asian market.

TechCrunch reviewed a portion of the exposed data that included the registered owner name, mailing address, email address and phone number of Hyundai Motor India customers who have serviced their vehicles at any of the company’s authorized service stations across India. The bug also disclosed vehicle details, including the registration number, color, engine number and mileage covered.

In a phone conversation on Thursday, Hyundai Motor India spokesperson Siddhartha P. Saikia said the company would provide a statement. When shared by email, the statement said:

We understand the importance of safeguarding the data of our customers and accordingly strive to create robust systems and processes. Further, these systems get periodically reviewed and updated based on needs. The Repair Order/Invoice link is shared only on the mobile number registered by the customer, once they have opted in to receive such updates. These are system-generated links without any human involvement. Hyundai assures continued efforts to safeguard the interest of the customers.

Hyundai Motor India did not answer questions about whether it had the technical means, such as logs, to determine any improper access to a customer’s records, nor would the company say if any bad actors exploited the issue.

Security researcher Ashutosh, who preferred not to be named in full, shared the details about the simple bug with TechCrunch. The bug exposed customers’ personal information through the web links Hyundai Motor India shared with customers over WhatsApp after receiving their vehicles for servicing at an authorized service station.

The web links that redirected customers to the repair orders and invoices in PDF files contained the customer’s phone number. A malicious actor could expose the information of other customers by changing the phone number in the link.

TechCrunch confirmed the researcher’s findings and emailed Hyundai Motor India on December 29. The company responded on January 4. TechCrunch shared the details of the bug with Hyundai Motor India on the same day, and requested Hyundai Motor India fix the bug within seven days due to its simplicity and severity. Hyundai Motor India fixed the bug on Thursday.

Upon receiving the company’s response, TechCrunch confirmed the bug was fixed, and the links in concern were no longer active and were redirected to a page giving an error message.

Established in 1996, Hyundai Motor India is among the top three carmakers in the country, alongside Maruti Suzuki and Tata Motors. Hyundai Motor India has a network of more than 1,500 service stations in the country. In May, the carmaker announced an investment of $2.45 billion (200 billion Indian rupees) over the next 10 years in the southern Indian state of Tamil Nadu to bolster its plans for electric vehicles.

Hyundai Motor India sign

Hyundai Motor India fixes bug that exposed customers' personal data

by with No Comment Tech

Hyundai Motor India sign

Image Credits: Ashish Vaishnav/SOPA Images/LightRocket / Getty Images

Hyundai’s India subsidiary has fixed a bug that exposed its customers’ personal information in the South Asian market.

TechCrunch reviewed a portion of the exposed data that included the registered owner name, mailing address, email address and phone number of Hyundai Motor India customers who have serviced their vehicles at any of the company’s authorized service stations across India. The bug also disclosed vehicle details, including the registration number, color, engine number and mileage covered.

In a phone conversation on Thursday, Hyundai Motor India spokesperson Siddhartha P. Saikia said the company would provide a statement. When shared by email, the statement said:

We understand the importance of safeguarding the data of our customers and accordingly strive to create robust systems and processes. Further, these systems get periodically reviewed and updated based on needs. The Repair Order/Invoice link is shared only on the mobile number registered by the customer, once they have opted in to receive such updates. These are system-generated links without any human involvement. Hyundai assures continued efforts to safeguard the interest of the customers.

Hyundai Motor India did not answer questions about whether it had the technical means, such as logs, to determine any improper access to a customer’s records, nor would the company say if any bad actors exploited the issue.

Security researcher Ashutosh, who preferred not to be named in full, shared the details about the simple bug with TechCrunch. The bug exposed customers’ personal information through the web links Hyundai Motor India shared with customers over WhatsApp after receiving their vehicles for servicing at an authorized service station.

The web links that redirected customers to the repair orders and invoices in PDF files contained the customer’s phone number. A malicious actor could expose the information of other customers by changing the phone number in the link.

TechCrunch confirmed the researcher’s findings and emailed Hyundai Motor India on December 29. The company responded on January 4. TechCrunch shared the details of the bug with Hyundai Motor India on the same day, and requested Hyundai Motor India fix the bug within seven days due to its simplicity and severity. Hyundai Motor India fixed the bug on Thursday.

Upon receiving the company’s response, TechCrunch confirmed the bug was fixed, and the links in concern were no longer active and were redirected to a page giving an error message.

Established in 1996, Hyundai Motor India is among the top three carmakers in the country, alongside Maruti Suzuki and Tata Motors. Hyundai Motor India has a network of more than 1,500 service stations in the country. In May, the carmaker announced an investment of $2.45 billion (200 billion Indian rupees) over the next 10 years in the southern Indian state of Tamil Nadu to bolster its plans for electric vehicles.

Apple Vision Pro headset

Apple fixes zero-day bug in Apple Vision Pro that 'may have been exploited'

by with No Comment Tech

Apple Vision Pro headset

Image Credits: Brian Heater

A day after reporters published their first hands-on review of Apple’s Vision Pro, the technology giant released its first security patch for the mixed reality headset to fix a vulnerability that “may have been exploited” by hackers in the wild.

On Wednesday, Apple released visionOS 1.0.2, the software that runs on the Vision Pro, with a fix for a vulnerability in WebKit, the browser engine that runs Safari and other web apps. Apple said the bug, if exploited, allowed malicious code to run on an affected device.

It’s the same vulnerability that Apple patched last week when it rolled out iOS 17.3, which included fixes for iPhones, iPads, Macs and Apple TV — all of which rely on WebKit. No patches for this bug, officially tracked as CVE-2024-23222, were released for Apple Watch.

It’s not immediately clear if malicious hackers used the vulnerability to specifically exploit Apple’s Vision Pro, and Apple spokesperson Scott Radcliffe would not say when asked by TechCrunch.

It also isn’t yet known who was exploiting the vulnerability, or for what reason.

It is not uncommon for malicious actors, such as spyware makers, to target weaknesses in WebKit as a way to break into the device’s underlying operating system and the user’s personal data. WebKit bugs can sometimes be exploited when a victim visits a malicious domain in their browser, or the in-app browser.

Apple rolled out several patches for WebKit bugs last year.

Vision Pro is expected to be available starting Friday.

I spent the morning with the Apple Vision Pro

Digitally generated image, perfectly usable for all kinds of topics related to digital innovations, AI, data processing, network security or technology and computer science in general.

Bugcrowd snaps up $102M for a 'bug bounty' security platform that taps 500K+ hackers

by with No Comment Tech

Digitally generated image, perfectly usable for all kinds of topics related to digital innovations, AI, data processing, network security or technology and computer science in general.

Image Credits: Getty Images

Bugcrowd — the startup that taps into a database of half a million hackers to help organizations like OpenAI and the U.S. government set up and run bug bounty programs, cash rewards to freelancers who can identify bugs and vulnerabilities in their code — has picked up a big cash award of its own to grow its business further: an equity round of $102 million.

General Catalyst is leading the investment, with previous backers Rally Ventures and Costanoa Ventures also participating.

Bugcrowd has raised over $180 million to date, and while valuation is not being disclosed, CEO Dave Gerry said in an interview it is “significantly up” on its last round back in 2020, a $30 million Series D. As a point of comparison, one of the startup’s bigger competitors, HackerOne, was last valued at $829 million in 2022, according to PitchBook data.

The plan will be to use the funding to expand operations in the U.S. and beyond, including potentially M&A, and to build more functionality into its platform, which — in addition to bug bounty programs — also offers services including penetration testing and attack surface management, as well as training to hackers to increase their skillsets.

That functionality is both of a technical but also human nature.

Gerry jokingly describes Bugcrowd’s premise as “a dating service for people who break computers,” but in more formal terms, it is built around a two-sided security marketplace: Bugcrowd crowdsources coders, who apply to join the platform by demonstrating their skills. The coders might be hackers who only work on freelance projects, or people who work elsewhere and pick up extra freelance work in their spare time. Bugcrowd then matches these coders based on those particular skills, with bounty programs that are in the works among clients. Those clients, meanwhile, range from other technology companies through to any enterprise or organization whose operations rely on tech to work.

In doing all this, Bugcrowd has been tapping into a couple of important trends in the technology industry.

Organizations continue to build more technology to operate, and that means more apps, more automations, more integrations and much more data is moving around from clouds to on-premises servers, from internal users out to customers and more. All of that means more opportunities for mistakes, or bugs, in the code — places where an integration may create a security vulnerability, for example; or simply result in a piece of coding no longer working as it should — and a greater need for comprehensive work to identify those gaps.

Recent years have seen a profusion of new security tools, powered by AI, that aim to identify and remediate those gaps in a more comprehensive and automated way. But that still has not replaced the role of human hackers. Those hackers might work in a more manual way, or they might use automation tools to help them in their bug-hunting efforts, but will still have a critical role to play in how that tech might be directed. As computer science continues to see a rise in popularity as a discipline, that’s produced a wider number of smart and technical people in the world who like to rise to that challenge, if not for the intellectual pursuit for the financial one. The most successful bug bounty hunters can make millions of dollars.

Gerry said that the startup’s been growing at over 40% annually and is approaching $100 million in annual revenues.

The startup is now mainly headquartered out of San Francisco, after being originally founded in Australia by Casey Ellis, Chris Raethke and Sergei Belokamen (Ellis is still with the company as chief strategy officer). It now has “well over” 500,000 hackers and is adding around 50,000 hackers annually to that number, Gerry said, and now has some 1,000 customers after adding 200 clients in the last year.

“Costanoa has watched Bugcrowd grow from an innovative concept for early adopters to being a force multiplier for Fortune 500 companies today,” said Jim Wilson, partner at Costanoa Ventures, in a statement. “Bugcrowd’s leadership team brings together seasoned experts with a deep understanding of cybersecurity trends and a proven ability to navigate the complexities of the industry. This next stage of growth under Dave’s leadership will allow them to expand their product offerings to help security executives get even more value from the crowd. We are excited to continue our partnership with the team to capture the significant opportunities ahead.”

A person holding a phone running the fertility tracking app Glow.

Fertility tracker Glow fixes bug that exposed users' personal data

by with No Comment Tech

A person holding a phone running the fertility tracking app Glow.

Image Credits: YouTube/Hello Doctor SA (opens in a new window)

A bug in the online forum for the fertility tracking app Glow exposed the personal data of around 25 million users, according to a security researcher.

The bug exposed users’ first and last names, self-reported age group (such as children aged 13-18 and adults aged 19-25, and aged 26 and older), the user’s self-described location, the app’s unique user identifier (within Glow’s software platform) and any user-uploaded images, such as profile photos.

Security researcher Ovi Liber told TechCrunch that he found user data leaking from Glow’s developer API. Liber reported the bug to Glow in October, and said Glow fixed the leak about a week later.

An API allows two or more internet-connected systems to communicate with each other, such as a user’s app and the app’s back-end servers. APIs can be public, but companies with sensitive data typically restrict access to its own employees or trusted third-party developers.

Liber, however, said that Glow’s API was accessible to anyone, as he is not a developer.

An unnamed Glow representative confirmed to TechCrunch that the bug is fixed, but Glow declined to discuss the bug and its impact on the record or provide the representative’s name. As such, TechCrunch is not printing Glow’s response.

In a blog post published on Monday, Liber wrote that the vulnerability he found affected all of Glow’s 25 million users. Liber told TechCrunch that accessing the data was relatively easy.

Contact Us

Do you have more information about similar flaws in fertility tracking apps? We’d love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email [email protected]. You also can contact TechCrunch via SecureDrop.

“I basically had my Android device hooked up with [network analysis tool] Burp and poked around on the forum and saw that API call returning the user data. That’s where I found the IDOR,” Liber said, referring to a type of vulnerability where a server lacks the proper checks to ensure access is only granted to authorized users or developers. “Where they say it should be available to devs only, [it’s] not true, it’s a public API endpoint that returns data for each user — simply attacker needs to know how the API call is made.”

While the leaking data might not seem extremely sensitive, a digital security expert believes Glow users deserve to know that this information is accessible.

“I think that is a pretty big deal,” Eva Galperin, the cybersecurity director at the digital rights non-profit Electronic Frontier Foundation, told TechCrunch, referring to Liber’s research. “Even without getting into the question of what is and is not [private identifiable information] under which legal regime, the people who use Glow might seriously reconsider their use if they knew that it leaked this data about them.”

Glow, which launched in 2013, describes itself as “the most comprehensive period tracker and fertility app in the world,” which people can use to track their “menstrual cycle, ovulation, and fertility signs, all in one place.”

In 2016, Consumer Reports found that it was possible to access Glow user’s data and comments about their sex lives, history of miscarriages, abortions and more, because of a privacy loophole related to the way the app allowed couples to link their accounts and share data. In 2020, Glow agreed to pay a fine of $250,000 after an investigation by California’s Attorney General, which accused the company of failing to “adequately safeguard [users’] health information,” and “allowed access to user’s information without the user’s consent.”

Palo Alto Networks' firewall bug under attack brings fresh havoc to thousands of companies

by with No Comment Tech

an illustration of a red light cast down on a bunch of computers

Image Credits: Bryce Durbin / TechCrunch

Palo Alto Networks urged companies this week to patch against a newly discovered zero-day vulnerability in one of its widely used security products after malicious hackers began exploiting the bug to break into corporate networks.

The vulnerability is officially known as CVE-2024-3400 and was found in the newer versions of the PAN-OS software that runs on Palo Alto’s GlobalProtect firewall products. Because the vulnerability allows hackers to gain complete control of an affected firewall over the internet without authentication, Palo Alto gave the bug a maximum severity rating. The ease with which hackers can remotely exploit the bug puts thousands of companies that rely on the firewalls at risk from intrusions.

Palo Alto said customers should update their affected systems, warning that the company is “aware of an increasing number of attacks” that exploit this zero-day — described as such because the company had no time to fix the bug before it was maliciously exploited. Adding another complication, Palo Alto initially suggested disabling telemetry to mitigate the vulnerability, but said this week that disabling telemetry does not prevent exploitation.

The company also said there is public proof-of-concept code that allows anyone to launch attacks exploiting the zero-day.

The Shadowserver Foundation, a nonprofit organization that collects and analyzes data on malicious internet activity, said its data shows there are more than 156,000 potentially affected Palo Alto firewall devices connected to the internet, representing thousands of organizations.

Security firm Volexity, which first discovered and reported the vulnerability to Palo Alto, said it found evidence of malicious exploitation going back to March 26, some two weeks before Palo Alto released fixes. Volexity said a government-backed threat actor that it calls UTA0218 exploited the vulnerability to plant a back door and further access its victims’ networks. The government or nation-state that UTA0218 works for is not yet known.

Palo Alto’s zero-day is the latest in a raft of vulnerabilities discovered in recent months targeting corporate security devices — like firewalls, remote access tools and VPN products. These devices sit at the edge of a corporate network and function as digital gatekeepers but have a propensity to contain severe vulnerabilities that render their security and defenses moot.

Earlier this year, security vendor Ivanti fixed several critical zero-day vulnerabilities in its VPN product, Connect Secure, which allows employees remote access to a company’s systems over the internet. At the time, Volexity linked the intrusions to a China-backed hacking group, and mass exploitation of the flaw quickly followed. Given the widespread use of Ivanti’s products, the U.S. government warned federal agencies to patch their systems and the U.S. National Security Agency said it was tracking potential exploitation across the U.S. defense industrial base.

And the technology company ConnectWise, which makes the popular screen-sharing tool ScreenConnect used by IT admins for providing remote technical support, fixed vulnerabilities that researchers deemed “embarrassingly easy to exploit” and also led to the mass exploitation of corporate networks.

Read more on TechCrunch:

A crypto wallet maker’s warning about an iMessage bug sounds like a false alarmPrice of zero-day exploits rises as companies harden products against hackersNSA says it’s tracking Ivanti cyberattacks as hackers hit US defense sectorResearchers warn high-risk ConnectWise flaw under attack is ’embarrassingly easy’ to exploit

Pressing down on electronic access control at door house

US government downgrades bug in Chirp Systems app that contained hardcoded password

by with No Comment Tech

Pressing down on electronic access control at door house

Image Credits: Getty Images

A vulnerability in a smart access control system used in thousands of U.S. rental homes went unfixed for years because Chirp Systems, the company that makes the system, ignored requests to fix the flaw.

U.S. cybersecurity agency CISA went public with a security advisory last month saying that the phone apps developed by Chirp, which residents use in place of a key to access their homes, “improperly stores” hardcoded credentials.

The agency has since downgraded its assessment, ruling out that the hardcoded credentials could have allowed remote control of any Chirp-compatible smart lock.

CISA’s advisory now says that an attacker within Bluetooth range could use the hardcoded password — which was “BEACON_PASSWORD” — to block the app’s ability to notify users when they are near a Bluetooth-enabled lock.

Chirp Systems said in a statement that the vulnerability could not be used to “take control of and gain unrestricted physical access to locks, doors, or gates managed by Chirp Systems.”

Apps that rely on passwords stored in the source code, known as hardcoding credentials, can be a security risk because anyone can extract and use those credentials to perform actions that impersonate the app.

CISA said it went public because Chirp Systems had not responded to either CISA or the researcher who found the vulnerability.

Security researcher Matt Brown told veteran security journalist Brian Krebs that he notified Chirp of the security issue in March 2021 but that the vulnerability went unfixed.

Chirp Systems is one of a growing number of companies in the property tech space that provide keyless access controls that integrate with smart home technologies to rental giants. Rental companies are increasingly forcing renters to allow the installation of smart home equipment as dictated by their leases, but it’s murky at best who takes responsibility or ownership when security problems arise.

Real estate and rental giant Camden Property Trust signed a deal in 2020 to roll out Chirp-connected smart locks to more than 50,000 units across over a hundred properties. Kim Callahan, a spokesperson for Camden, did not respond to a request for comment.

Chirp was bought by property management software giant RealPage in 2020, and RealPage was acquired by private equity giant Thoma Bravo later that year in a $10.2 billion deal. RealPage is facing several legal challenges over allegations its rent-setting software uses secret and proprietary algorithms to help landlords raise the highest possible rents on tenants.

Jennifer Bowcock, a spokesperson for RealPage, referred TechCrunch to its published statement but did not answer our questions. Megan Frank, a spokesperson for Thoma Bravo, did not respond to requests for comment.

Updated on May 2 with new information from CISA downgrading the vulnerability, including a statement from Chirp Systems. This story also has a new headline to reflect the changes.

How did a rental startup I’d never heard of leak my home address?