Another day brings news of another popular web service getting hacked and having its data stollen. The victim this time is a popular mobile app called TrueCaller. The Syrian Electronic Army claims to have breached TrueCaller's security by exploiting a WordPress flaw and stealing 7 databases.
The Syrian Electronic Army claims to have gained access to 1 million social networking accounts (Facebook, LinkedIn, Twitter and Google) through this exploit. The company itself acknowledged the hack on its website but provided this clarification:
“Our investigation into the matter indicates the attackers were able to access ‘tokens’, which was immediately reset. Metaphorically speaking, a ‘token’ is a unique lock for each user, but what the attackers did not acquire is the needed key, which has also been reset,”
Unfortunatly the truth probably lies somewhere in between both extreme statements.
The SEA also provided this database screenshot as "proof":
After they had harvested the information they needed, they added salt to the injury by publishing the login credentials and database name:
The moral of the story? We need to start demanding better security from cloud services and we need to be more judicious about what we store in the cloud.