QuickBlox API Vulnerabilities Open Video, Chat Users to Data Theft
QuickBlox users should update to the latest version of the platform in order to protect against several avenues of exploitation.
![concept photo of cybersecurity with someone on their laptop concept photo of cybersecurity with someone on their laptop](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltfc7d584a188e78a6/64f173ff8f62341f1f11216c/HackerWithMap_NicoElNino_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
After digging into QuickBlox's software development kit and application programming interface (API), Team 82 alongside Check Point Research found that there were critical vulnerabilities putting the personal data of millions of people at risk.
QuickBlox is a chat and video calling platform in use across various industries, including finance and telemedicine. In researching the platform's vulnerabilities, Team 82 and Check Point Research pioneered several proof-of-concept exploits for applications running the API.
The teams also provided examples of how secret tokens and passwords in the QuickBlox architecture could allow threat actors to source information about QuickBlox users. The researchers found unique ways to exploit these vulnerabilities and carry out potential attacks, ultimately allowing them to remotely open doors using intercom features or leak patient information from a telemedicine platform.
Team82 and Check Point Research worked with QuickBlox to find solutions to the issues, including new architecture for its platform and a whole new API. Users of QuickBlox are advised to migrate to the latest versions for both updates.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024