True, which bills itself as the social networking app that will “protect your privacy,” has experienced a security lapse which left one of its servers exposed without a password — spilling private user data to the internet for anyone to read, browse and search the database. The dashboard contained daily server logs dating back to February, and included users’ registered email address or phone number, the contents of private posts and messages between users, and the user’s last known geolocation, which could identify where a user was or had been. The dashboard also exposed the email and phone contacts uploaded by the user, which True uses to match with known friends in the app. None of the data was encrypted.
Leaving a database exposed without a password in place puts customer data in serious jeopardy of being exploited by threat actors. A missing password is often the result of lack of awareness into the constantly changing cloud environment. Without the proper guardrails to remediate oversights in security, any change in policy can leave a database exposed and put sensitive information in danger of being used for targeted phishing campaigns or sold on the dark web. Platforms that provide a holistic view into the cloud landscape ensure businesses can stay apprised of all changes and avoid devastating misconfigurations putting customers at risk.