Indecent disclosure: Gay dating app left “private” images, data exposed to Web (Updated)

Enlarge / The Jack'd dating app allowed men to upload 'private' photos—but stored them open to public viewing, the same as the rest.
[Update, Feb. 7, 3:00 PM ET: Ars has confirmed with testing that the private image leak in Jack'd has been closed. A full check of the new app is still in progress.]
Amazon Web Services' Simple Storage Service powers countless numbers of Web and mobile applications. Unfortunately, many of the developers who build those applications do not adequately secure their S3 data stores, leaving user data exposed—sometimes directly to Web browsers.  And while that may not be a privacy concern for some sorts of applications, it's potentially dangerous when the data in question is 'private' photos shared via a dating application.
Jack'd, a 'gay dating and chat' application with more than 1 million downloads from the Google Play store, has been leaving images posted by users and marked as 'private' in chat sessions open to browsing on the Internet, potentially exposing the privacy of thousands of users. Photos were uploaded to an AWS S3 bucket accessible over an unsecured Web connection, identified by a sequential number. By simply traversing the range of sequential values, it was possible to view all images uploaded by Jack'd users—public or private. Additionally, location data and other metadata about users was accessible via the application's unsecured interfaces to backend data.
Read 16 remaining paragraphs | Comments