#Voxox wiki android
#Voxox wiki series

This is the latest in a series of exposures involving ElasticSearch instances, a popular open source search and database software. Given the vast amount of European users’ information in the database, the company may also face penalties under the EU’s General Data Protection Regulation, which can impose fines of up to four percent of the company’s global annual revenue for serious breaches.īut given its China-based presence, it’s not clear, however, what actionable repercussions the company could face. We asked Boomoji if it has or plans to inform California’s attorney general of the exposure as required by state law, but the company did not answer. All of the data was stored in plaintext.Īlthough Boomoji is based in China, it claims to follow California state law, where data protection and privacy rules are some of the strongest in the U.S. So long as the app was installed and had access to the contacts, new phone numbers would be automatically uploaded. When we were prompted to allow the app access to our contacts list, the entire dummy contact list was uploaded instantly - and viewable in the database. To find friends, the app matches your contacts with those registered with the app in its database. Given Boomoji’s response, we verified the contents of the database by downloading the app on a dedicated iPhone using a throwaway phone number, containing a few dummy, but easy-to-search contact list entries. To our knowledge, there’s no way to opt out or have your information deleted. Each record was linked to a Boomoji’s unique ID, making it relatively easy to know whose contact list belonged to whom.Įven if you didn’t use the app, anyone who has your phone number stored on their device and used the app more than likely uploaded your number to Boomoji’s database. One table had more than 125 million contacts, including their names (as written in a user’s phone book) and their phone numbers.

Worse, the database contained every phone book entry of every user who had allowed the app access to their contacts. That unique ID also included the precise geolocation of more than 375,000 users that had allowed the app to know their location at any given time. Those other tables included if and which school they go to - a feature Boomoji touts as a way for users to get in touch with their fellow students. Each record contained their username, gender, country and phone type.Įach record also included a user’s unique Boomoji ID, which was linked to other tables in the database.

#Voxox wiki android

The database contained records on all of the company’s iOS and Android users - some 5.3 million users as of this week. “These two accounts were made by us for testing purposes,” said an unnamed Boomoji spokesperson in an email. And, because the database was listed on Shodan, a search engine for exposed devices and databases, they were easily found with a few keywords.Īfter TechCrunch reached out, Boomoji pulled the two databases offline. The China-based app developer left the ElasticSearch databases online without passwords - a U.S.-based database for its international customers and a Hong Kong-based database containing mostly Chinese users’ data in an effort to comply with China’s data security laws, which requires Chinese citizens’ data to be located on servers inside the country.Īnyone who knew where to look could access, edit or delete the database using their web browser. Popular animated avatar creator app Boomoji, with more than five million users across the world, exposed the personal data of its entire user base after it failed to put passwords on two of its internet-facing databases.