Kardashian website security flaw exposes data for over 600,000 users

The Kardashian’s new mobile apps may be extremely popular, but the websites recently launched alongside those offerings had a major flaw. An open unsecured API provided developer Alaxic Smith access to the names and email addresses of hundreds of thousands of subscribers when poked around Kylie Jenner’s site — over 600,000 on that site alone. What’s more, Smith discovered that the same API was used across the other sister’s sites, too. However, no payment info was accessible due to the fact that the sites themselves don’t handle any funds, leaving that up to app stores and third-party services.

Whalerock Industries, the company that runs both the Kardashian sites and apps says that it was alerted to the issue just after launch and the API was “promptly closed.” Whalerock also says that Smith, who authored a blog post on the whole thing, was only able to peruse “a limited set” of user info and that access to passwords and payment info wasn’t touched. Smith has since pulled his post and Whalerock is in the process of finding out just what he saw and if he actually archived the findings. It turns out stumbling upon a security flaw and posting about it when some of the biggest celebs are involved could get you more than you bargained for.

[Image credit: James Devaney/GC Images]

Filed under:
Internet

Comments

Source:
TechCrunch

Tags: api, flaw, kardashian, security, website

China asks US tech companies to follow its security policies

You know how Russia recently took the contentious step of insisting that Google and Twitter keep Russian user data on servers within the country itself, presumably to facilitate government searches? China apparently tried to pull the same stunt earlier this year with a number of American tech companies, according to unnamed New York Times sources. The document reportedly sought to have companies pledge that they would not harm China’s national security and that their products be “secure and controllable”, another way of saying “give us mandatory backdoor access and the encryption keys”. The NY Times article does not name the IT companies targeted, however it did state that the document came from the China Information Technology Security Evaluation Center likely with pressure coming down from the country’s internet regulation agency.

This news arrives ahead of President Xi Jinping’s first official state visit to the United States. The two countries have been quietly feuding over a number internet issues over the past few years — from censorship and cyber-security to taxation and financial regulation. The presidential visit is further complicated by the international tech forum being held in Seattle by China’s internet czar, Lu Wei. The forum is timed to directly coincide with the visit and, according to the NY Times report, is as much a show of influence against the US government (ie “hey, look at us make your IT companies jump”) as it is a conference.

Reuters also reports that China has restarted its work on controversial cyber-banking regulations as well. The project, which was suspended earlier this summer, would coerce Chinese lenders into purchasing more domestic IT products and would require foreign IT companies to disclose any secret source code to Beijing. Understandably, the Western IT industry (as well as the US and European governments) were none too pleased and lobbied heavily against it.

[Image Credit: Getty]

Filed under:
Internet

Comments

Via:
Reuters

Source:
New York Times

Tags: Beijing, censorship, China, cybersecurity, Google, New York Times, pledge, regulation, Russia, surveillance, United States, Xi Jinping