[Contained][Severity: Critical][Misconfiguration]

Suishow: a cloud setting flaw in its location SNS "NauNau" left location data and more viewable

After press reports it stopped the service on October 21. The investigation found that location data, chats and more could be viewed by a specific procedure. No leak was confirmed.

Disclosed

2023-10-23

Organizations involved

Leaked or at risk

3.8M

3,800,000

Downtime

Unknown

What happened

2023-10-20
A news organization pointed out that the location data, chats and more of at least two million users could be viewed from outside. [1]
2023-10-21
It stopped the service and blocked access. [1]
2023-10-23
It reported to the Ministry of Internal Affairs and Communications and the PPC, and its parent Mobile Factory announced the press reports. [1]
2023-12-04
The third-party investigation was completed. [1]
2023-12-07
It published the investigation results. [1] [2]

Impact

The cause was a security setting flaw in the cloud service the app uses, which allowed unauthorized access to the database. Getting location data or chat history, however, required the knowledge to intercept and analyze the app's encrypted traffic and to build requests to the cloud API. Within the scope of the third-party investigation, no leak was confirmed. [1]

The viewable data was estimated at 3.04 million users for current location, 1.67 million for chat content and images, 2.83 million for birth date and 3.8 million for other information without personal data. It also covered past location history of 16,753 users, couple and family group membership of 53,457 users and the install status of specific apps for 38,070 users. The service will restart once the prevention measures are set. [1]