31 Million of client records belonging to the virtual keyboard app AI.type leaked online

The misconfigured MongoDB database exposed 577 GB of data online, the records include sensitive details on the users, and the worst thing is that such data was not even necessary for the app to work. Researchers highlighted the fact that the Ai.Type request “Full Access” to all data stored on the mobile devices.

“When researchers installed Ai.Type they were shocked to discover that users must allow “Full Access” to all of their data stored on the testng iPhone, including all keyboard data past and present. It raises the question of why would a keyboard and emoji application need to gather the entire data of the user’s phone or tablet?” continues the post.

“Based on the leaked database they appear to collect everything from contacts to keystrokes. This is a shocking amount of information on their users who assume they are getting a simple keyboard application.”

The leaked data includes:

• Full name, phone number, and email address
• Device name, screen resolution and model details
• Android version, IMSI number, and IMEI number
• Mobile network name, country of residence and even user enabled languages
• IP address (if available), along with GPS location (longitude/latitude).
• Links and the information associated with the social media profiles, including birth date, emails, photos.

The researcher made another shocking discovery,  the 6,435,813 records contained data collected by the app from users’ contact books. The leaked database included more than 373 million records scraped from registered users’ phones, which include all their contacts saved/synced on linked Google account.

The archive also includes a range of statistics.

“There was a range of other statistics like the most popular users’ Google queries for different regions. Data like average messages per day, words per message, the age of users, words_per_day’: 0.0, ‘word_per_session and a detailed look at their customers,” the researchers say.

The real question is, “why would like a keyboard, and emoji application need to gather the entire data of the user’s phone or tablet?”

Pierluigi Paganini

(Security Affairs – Google Unwanted Software Policy, privacy)

[adrotate banner=”5″]

[adrotate banner=”13″]