A SQL database containing 1.3 million scraped Clubhouse user records has been leaked on a popular hacker forum for free, CyberNews reports.
The leaked database contains Clubhouse user-related information, including name, user ID, photo URL, username, Instagram and Twitter handle, number of followers and the people they follow, invited by user profile name and account creation date.
The company’s April 11 statement on Twitter denied that it has been hacked or breached, and noted that the “data referred to is all public profile information from our app, which anyone can access via the app or our API.”
Mantas Sasnauskas, a senior information security researcher for CyberNews, said that the Clubhouse app’s design “lets anyone with a token, or via an API, to query the entire body of public Clubhouse user profile information, and it seems that token does not expire.”
He added that Clubhouse should make an extra effort to inform the public about its privacy policy on data scraping and mining. “This should not only be reflected in the ToS, but also in the technical implementation of the app, making it harder for anyone to scrape user data. Having no anti-scraping measures in place can be seen as a privacy issue.”
Jill Aitoro leads editorial for SC Media, and content strategy for parent company CyberRisk Alliance. She 20 years of experience editing and reporting on technology, business and policy.
Software firms have been urged by the FBI and Cybersecurity and Infrastructure Security Agency to ensure the absence of path traversal or directory traversal vulnerabilities in their products prior to shipping, BleepingComputer reports.
BleepingComputer reports that numerous Android apps with over four billion downloads are susceptible to the novel Dirty Stream attack, which involves the exploitation of a flaw in Android's content provider system that could enable arbitrary code execution and secrets compromise.