Pierluigi Paganini March 27, 2016

Security researchers from the Cheetah Mobile Security Research Lab discovered a severe flaw in the call management application Truecaller.

Recently, security researchers from the Cheetah Mobile Security Research Lab discovered a severe loophole in the popular phone call management application Truecaller.

This vulnerability allows anyone to steal Truecaller users’ sensitive information, potentially opening doors for attackers. Overall, more than 100 Million Android users who have downloaded this app on their smartphones are in danger.

The researcher found that Truecaller uses the devices’ IMEI as the only identity label of its users. Meaning that anyone gaining the IMEI of a device will be able to get Truecaller users’ personal information (including phone number, home address, mail box, gender, etc.) and tamper app settings without users’ consent, exposing them to malicious phishers.

By exploiting this flaw, the attackers can:

• Steal personal information like account name, gender, e-mail, profile pic, home address, etc.
• Modify a user’s application settings:
• Disable spam blockers
• Add to a black list for users
• Delete a user’s blacklist

The Cheetah Mobile Security Research Team notified the developer of Truecaller about this vulnerability as soon as they discovered the loophole and offered all it could to help the developer fix the issue. Now the maker of Truecaller has addressed the issue and released an update on March 22nd.

Although the flaw has been fixed in the latest version, the majority of the users are still in danger as they have not got access to the new release yet. The CM Security Research Lab advises Truecaller users to upgrade this app to the latest version as soon as possible.

[adrotate banner=”9″]

Written by Cheetah Mobile Security Research Lab

(Security Affairs – VNC Roulette, hacking)