[NEWS] Jewish dating app JCrush exposed user data and private messages – Loganspace

A security lapse at JCrush, a dating app designed for the Jewish neighborhood, left a databases launch with out a password, exposing sensitive person files and non-public messages to anyone who knew where to belief.

The positioning’s backend database had around around 200,000 person files, basically based on security researchers Noam Rotem and Ran Locar, who shared their findings exclusively with TechCrunch and wrote up their findingsat vpnMentor.

None of the suggestions became once encrypted, the researchers told TechCrunch.

We got a sample of the suggestions to examine. From what we noticed, the suggestions contained the person’s establish, gender, email take care of, IP take care of, geolocation as successfully as their metropolis, remark and nation, date of start, their sexual preferences, their religious denomination, and the photos they use on JCrush.

Depending on how the person signed up, the suggestions additionally show the person’s Fb ID, which facets straight to their Fb profile. It additionally involves the salvage correct of entry to token, that can more than doubtless well additionally be extinct to steal over a JCrush person’s legend with out needing their password.

In some instances, the geolocation files became once so honest it became once easy to establish exactly where some users lived — in particular in residential neighborhoods.

The database additionally contained non-public messages — many were explicit and graphic.

Although the researchers didn’t dig into the suggestions — mindful of the privacy implications — they chanced on files pertaining to to “incognito” accounts, which allow users to pay to browse the positioning anonymously.

The app’s founder Natasha Nova did no longer answer to a search files from for comment. An unnamed spokesperson for JCrush’s parent firm Northsight Capital said it became once “mindful” of the misfortune and “secured the database straight when the misfortune happened.”

“There had been no longer been any indications that the suggestions had been accessed by malicious events or misused in anyway,” said the firm. When requested, the firm did no longer mutter what evidence it had for its remark, but accepted that the firm plans to relate its users and authorities of the incident.

It’s the most up-to-the-minute in a series of files publicity at dating apps, or companies thattout anonymityand privacy.

Final year, a dating app for conservative supporters —Donald Daters— admitted a database leak on its first day of operations. Greatest about 1,600 users had their files exposed. In Could, a preferred Chinese language dating app for homosexual and outlandish ladies, Rena, which hadbetter than five million users, left its database launch and exposed.

Read extra:

• Rela, a Chinese language lesbian dating app, exposed 5 million person profiles
• At Blind, a security lapse published non-public complaints from Silicon Valley employees
• Donald Daters, a dating app for Trump supporters, leaked its users’ files
• Security lapse exposed non-public Theta photos
• After breach, Stack Overflow says some person files exposed
• An unsecured SMS spam operation doxxed its owners