Researchers have revealed a cybersecurity breach affecting around 1.5 million private images from various dating apps associated with the kink and LGBT communities. Under scrutiny are five platforms developed by M.A.D Mobile, including kink-oriented BDSM People and the sugar daddy app Chica, along with LGBT-niche services like Pink, Brish, and Translove. The vast collection of explicit images, accessible to anyone who had the link, raised alarm bells regarding user safety and privacy.
The security flaw was initially pointed out to M.A.D Mobile on January 20, but only acted upon after the BBC's inquiry prompted action. Although the company has since addressed the vulnerability, it has not disclosed how it occurred or the reasons for the delay in response. This revelation has sparked concerns over the potential risks faced by the apps' users, many of whom might live in countries where there is antagonism towards the LGBT community.
The initial discovery was made by ethical hacker Aras Nazarovas from Cybernews, who identified the lack of password protection for the storage of these sensitive images by examining the source code. Nazarovas expressed his shock at the ease with which he could access the unprotected images. He explained, "The first app I investigated was BDSM People, and the first image in the folder was a naked man in his thirties. As soon as I saw it, I realised that this folder should not have been public."
With malicious hackers potentially having access to such private material, there is a risk of extortion for users. Although the images were not tied to user names or any identifiable data, the threat remains significant, particularly for individuals residing in hostile environments.
In response to the breach, a spokesperson for M.A.D Mobile acknowledged the vulnerability's discovery and expressed gratitude towards the researcher for preventing a broader data breach. They noted that further updates would be implemented within days. Notably, some researchers typically wait to report vulnerabilities until they are resolved to safeguard users, but Nazarovas and his team made the decision to alert the public beforehand, prioritizing user awareness.
Historically, the consequences of data breaches in similar contexts are significant, as evidenced by the 2015 hacking incident involving Ashley Madison, where sensitive user information was leaked. As the digital landscape continues to evolve, the need for robust security measures in dating environments is increasingly imperative.
