Recent revelations show that nearly 1.5 million private images from various dating applications, including those catering to the LGBT and kink communities, were left vulnerable online, potentially exposing unwitting users to hackers and extortionists. Five different platforms, developed by M.A.D Mobile, including BDSM People and Chica, were confirmed to have unprotected databases accessible to anyone with the pertinent link.
The unprotected images, many of which contain explicit content, sparked alarm among the estimated 800,000 to 900,000 individuals utilizing these specialized dating services. The problem came to light when ethical hacker Aras Nazarovas from Cybernews discovered the unsecured online storage while analyzing the code of the applications, finding rudimentary access to unencrypted photos without any need for a password.
Nazarovas described the poignant moment as he unearthed private images, stating, "The first app I investigated was BDSM People, and the first image in the folder was a naked man in his thirties. As soon as I saw it, I realized that this folder should not have been public." In addition to profile pictures, the leak revealed privately sent images and those removed by moderators as well.
Despite a warning issued to M.A.D Mobile regarding the security vulnerability back in January, the company only acted to rectify the situation after receiving correspondence from the BBC on Friday, failing to disclose the reasons for the initial inaction. Following the alerts, M.A.D Mobile confirmed that measures were in place to correct the security issue but cautioned that no permanent assurance existed that other malicious actors had not already accessed the sensitive material.
Addressing the looming risks, Nazarovas highlighted the imminent danger for users, especially those residing in regions hostile to LGBT rights, emphasizing the potential for blackmail and targeted attacks due to the exposure of such sensitive information. Despite only images being affected, the unlabelled nature of the stored files complicates the path for targeted threats against users.
The company issued accolades to the researcher for bringing the vulnerability to light but remained tight-lipped regarding further questions about the extent of the issue and the steps taken in response. Typically, security experts refrain from making vulnerabilities public until fixes are in place to avert endangerment to users, but Nazarovas’ team made the decision to alert the public due to concerns about potential predicaments that could arise from the inaction of M.A.D Mobile.
This security breach stands as a stark reminder echoing past experiences like the notorious Ashley Madison data leak in 2015, underlining the necessity for companies to prioritize user security within the rapidly evolving landscape of online dating applications.
