India-Based Local Search Engine Company Had A Bug That Affected 156 Million Users

No software is perfect, and Justdial, an Indian local search app, has tasted the bitterness of software vulnerability.

First reported by MoneyControl, the bug was first discovered by security researcher Ehraz Ahmed in September. What the bug did, was allowing hackers to exploit the site’s Register API that is used for sign-ups.

The bug that was present on Justdial's website, mobile website, app and voice platforms, allowed hackers to login into any of Justdial's 156 million users accounts.

Apart from accessing user information such as names, phone numbers, and email addresses, the vulnerability also allowed hackers to peek into Justdial users' financial details including balance and transactions made through JustDial Pay, the company’s payment service.

In the video uploaded by Ahmed. he showed how a hacker can use only a person’s phone number as username and gain access to the account through the flaw.

The flaw in turn would then provide access token, system ID (SID) and user ID (UID).

In other words, the bug allowed hackers to even change user account details for Justdial Pay so all the money sent to that account gets redirected.

However, this didn't happen because Justdial has a precaution which requires users to enter an additional PIN before doing any money transfer.

This has been confirmed by Justdial, as it acknowledges the presence of this bug.

[block:block=86]

According to the company, there wasn't any loss of data or money has been reported.

Justdial also confirmed that the bug has been fixed, saying that:

"We at Justdial take security seriously. There was a bug in one of our APIs which could potentially be accessed by an expert hacker. This bug has been fixed."

"We work with various security researchers to strengthen our platform and would like to thank Ehraz Ahmed for bringing this out to us."

Founded in 1996 by VSS Mani, Justdial is a company that provides local search for different services in India over the phone and online.

Earlier this April, it was reported that a similar data breach was experienced by Justdial, affecting more than 100 million users, including names, email addresses, mobile numbers, gender, date of birth and addresses. However, the Mumbai-based firm had denied the breach.