Lifeprinter app on iOS and Android leaked 2 million private photos: Cybernews

The latest Cybernews research team findings show that Lifeprint, a portable photo printer for iPhone and Android, spilled millions of private photos onto the open internet.

Any internet user could have accessed over 8 million files, including 2 million unique photos, exported user data in JSON and CSV formats, and lists of usernames, email addresses, and printing stats for more than 100,000 users.

Key research takeaways: 

  • The leak was caused by a misconfigured bucket that lacked authentication.
  • According to the stored metadata, these users printed 1.6 million photos together.
  • The research team also found that the public cloud bucket contained multiple versions of the printer’s firmware. Buried inside the files was a private encryption key, left in plain text, which appeared to be used to sign the firmware.

Possible threats

Lifeprint users face multiple risks, such as identity exposure through leaked personal information. Leaked photos can often be intimate, exposing the user’s private life to anyone on the internet. Also, the leaked personal information could be used in identity theft, harassment, and doxxing attacks.

Also, affected users are in theoretical danger of malicious firmware taking over their devices. Cybernews contacted the company, but no response was received.

To read the full research, please click here.

Leave a Reply

Discover more from The IT Nerd

Subscribe now to keep reading and get access to the full archive.

Continue reading