- Cybernews found an inenesting Mongodb instance belonging to Hereero
- The database contained millions of records and PII
- It has since been locked, but users should always be on their care
Safety researchers of Cyberness reported the discovery of a massive Mongodb body belonging to a meeting of meetings and connection called Hearero.
The database contained more than 350,000 user records, more than three million chat recordings and more than a million chat room recordings.
Among the data on display are names, email addresses, social connection identifiers, JWT tokens, profile images, device tokens, sexual preferences, MST status and – Exletent GPS locations.
No proof of abuse
Cyberness contacted the developers of the application, an American company named Thotexperiment, which immediately locked the database. The company told researchers that it was a test database, but Cybernews’ analysis indicates that it could rather be real data from users.
Unfortunately, we do not know how long the database has remained open, and if threat actors have accessed in the past. So far, there is no evidence of abuse in nature.
The human error leading to exposed databases remains one of the most common causes of data leaks and security violations.
Researchers constantly scan the Internet with specialized search engines, finding massive databases not-protected by service words almost daily.
These leaks can put people in danger because cybercriminals can use information to adapt very convincing phishing attacks, through which they can deploy malware, steal sensitive files and even commit wired fraud.
Headero users are advisable to be more vigilant when receiving unlined messages, both by email and in social platforms.
They should also take care not to download files or click on links in these messages, especially if messages have a sense of urgency with them. If they use the same password on several services, they should modify them and erase the sessions / Revoke the tokens in the applications, if possible.
