The IT Nerd

What happens in your AI-generated erotica app… apparently doesn’t stay there.

Cybernews researchers discovered that Novel AI: Book Creator – an iOS app with nearly 2,000 App Store reviews – exposed over 55,000 user-generated stories, some of them heavily NSFW, along with customer support emails and personal data via a misconfigured Firebase database.

Why it matters:

• Blackmail bait: exposed stories + email addresses = a sextortion goldmine
• Hardcoded secrets: the app also leaks keys, tokens, and IDs that could give attackers backend access
• Silent devs: the developers have yet to respond, even months after disclosure
• Systemic problem: 71% of the 156,000 iOS apps we analysed leak at least one secret

You can read the full Cybernews report here.

The iOS app Photo Vault, designed to protect private content, has leaked user data in real time due to a misconfigured, passwordless Firebase database.

What was exposed:

• Metadata from 17,000 photo albums
• 56 password entries
• 81 private notes, some labeled “passwords”

Because of this flaw, attackers could watch as users uploaded content, and potentially use that data to hijack accounts or infiltrate linked services like Facebook or Dropbox.

You can read the full Cybernews investigation here.

Cybernews has uncovered a terrifying security flaw in a popular iOS tracker app used by over 320,000 people to monitor their kids’ locations. 

The app’s misconfigured Firebase database has exposed real-time GPS data, phone numbers, and other sensitive details, putting users at risk of stalking and worse.

As more parents rely on tracking apps to keep their children safe, this flaw is a major security threat with wide-reaching implications. 

Please find the full Cybernews report here.

Last week, I posted findings from Cybernews on the security weaknesses in popular iOS dating apps such as BDSM People and PINK. Today, I’m bringing your attention to another shocking discovery: a serious security flaw in the app Gay Daddy: 40+ Date & Chat that directly threatens the privacy and safety of its users.

Cybernews researchers uncovered that the app is leaking over 50,000 user profiles and 124,000 private messages, exposing sensitive data such as names, ages, relationship status, HIV status, location data, and even private photos – everything from awkward selfies to, well, let’s just say, less-than-innocent “self-expressions.”

Why? Hardcoded credentials and misconfigured Firebase security left the app’s backend wide open to anyone with basic technical knowledge. While the app markets itself as a “private and anonymous community,” the reality was anything but secure.

The app’s API keys and cloud storage credentials were also leaked, which makes exploitation even easier.

The app has an estimated 20,000+ downloads and a 3.7-star rating on the App Store in the US.

Due to this flaw, users could be targeted by scammers, blackmailers, or even face physical harm, especially in regions where LGBTQ+ individuals face discrimination.

Read the full report here. 

The Cybernews research team has uncovered a massive privacy oversight: iOS dating apps catering to the LGBTQ+, BDSM, and sugar dating communities have leaked nearly 1.5 million private user photos – including explicit images sent in private messages.

Apps developed by M.A.D Mobile Apps Developers Limited, including BDSM People, CHICA, TRANSLOVE, PINK, and BRISH, were found exposing sensitive user data due to publicly accessible hardcoded secrets in their code. 

This flaw allowed unauthorized access to storage buckets containing highly sensitive content, putting users at risk of extortion, social engineering attacks, and, in some cases, even persecution in countries where LGBTQ+ identities are criminalized.

Key takeaways:

• 1.5 million private images exposed, including verification photos, chat images, and moderator-removed content.
• BDSM People app alone leaked 541,000 private images, including 90,000 from direct messages.
• Sugar dating app CHICA leaked 133,000 photos, including private chats.
• Three LGBTQ+ dating apps exposed over 1.1 million images, with BRISH, PINK, and TRANSLOVE all compromised.
• Hardcoded API keys and storage credentials allowed full access to Google Cloud storage, requiring no authentication.

Given the sensitive nature of these dating platforms, these weak spots could have severe personal and legal consequences for affected users. Cybernews researchers have reached out to the developers, but no response has been received.

Read the full report here. 

The Trump Administration discussed a secret military operation on Signal, inadvertently adding Jeffrey Goldberg, the editor-in-chief of The Atlantic, to the thread. Until the bombs started dropping in Yemen, Goldberg couldn’t believe what he was reading.

Even if Goldberg hadn’t been included in the chat, it remains a terrible idea to discuss matters of national security via any app, no matter how secure it is considered. This point, while likely to ruffle some feathers in the political arena, should also serve as a stark reminder that nothing you do online is truly anonymous.

Here’s what you should consider before confiding your secrets to technology

1. You are more interesting than you think.

It’s a common misconception that regular citizens like you and me are of no interest to hackers. However, a threat actor could exploit your device to gain access to your employer. By exploiting the data on your phone, a hacker could steal your identity and potentially cripple the entire organization.

2. Don’t blindly trust what technology companies tell you.

Encrypted chat apps Signal and WhatsApp are publicly debating which one is more secure. Meredith Whittaker, the president of Signal, appears to be particularly annoyed by WhatsApp’s Will Cathcart, who suggests there are hardly any differences between WhatsApp and Signal.

While Signal is generally considered a more trustworthy choice by the security community — and it’s worth noting that WhatsApp is owned by Meta — I still recommend exercising caution when using either app.

Recall how in 2021, Proton, another security-focused company, provided the IP address of a French activist to law enforcement due to legal obligations. Many remain upset about this incident, but it also serves as a reminder, as Proton’s Andy Yen noted, that “the Internet is generally not anonymous.”

3. Governments are increasingly asking for a backdoor.

The “good guys,” meaning law enforcement, want to have a key to your communication just in case it can be instrumental in some criminal case. Governments have long argued that end-to-end encrypted communication is an obstacle when trying to solve high-profile human trafficking, drug trafficking, and child exploitation cases, among others.

In some countries, the “good guys” might actually succeed in having those backdoors installed. While such amendments are theoretically intended to target only criminals, they set a very dangerous precedent. This is because governments often view protesters, dissidents, and political opponents as threats to national security or even sovereignty, effectively treating them as criminals.

4. Your phone might get stolen.

Are you the only one who knows your phone’s passcode? Is it a random sequence of numbers or something more meaningful, like someone’s birthday? Imagine what would happen if Goldberg’s phone were stolen. While it’s not child’s play to unlock it, it can be cracked through brute force.

Even though Signal offers encryption, the recent leak of military plans emphasizes the need for caution, even on trusted platforms. It’s crucial for every user, including government officials, to double-check contact identities, use additional layers like two-factor authentication, and be mindful of what’s shared. No tool is foolproof, and the failure to implement proper security measures shows that awareness and caution are just as important as the technology in use.

ABOUT THE EXPERT 

Jurgita Lapienytė is the Editor-in-Chief at Cybernews, where she leads a team of journalists and security experts dedicated to uncovering cyber threats through research, testing, and data-driven reporting. With a career spanning over 15 years, she has reported on major global events, including the 2008 financial crisis and the 2015 Paris terror attacks, and has driven transparency through investigative journalism. A passionate advocate for cybersecurity awareness and women in tech, Jurgita has interviewed leading cybersecurity figures and amplifies underrepresented voices in the industry. Recognized as the Cybersecurity Journalist of the Year and featured in Top Cyber News Magazine’s 40 Under 40 in Cybersecurity, she is a thought leader shaping the conversation around cybersecurity.

Apple’s UK encryption rollback has reignited the global debate on privacy. But while all eyes are on government backdoors, the latest Cybernews research exposes an even bigger risk – iOS apps are leaking sensitive data at scale, and Apple isn’t doing much if anything to stop it.

Last week, the Cybernews research team revealed that 71% of 156,000 iOS apps are leaking hardcoded secrets – a serious security flaw with major implications for businesses and consumers.

Now, their latest report dives deeper into the top 10 most commonly exposed secrets and why they pose a significant risk to user data, whether owned by consumers or businesses.

Here’s a quick look at the top 3 threats for businesses and individuals:

• Project ID (Google) exposes app resources, logs, and potentially weakly secured services, increasing the likelihood of data breaches.
• Google App ID can be used to impersonate apps, granting unauthorized access to user data, APIs, and backend systems.
• API Keys (Google): if exposed, these can lead to unauthorized service access, risking data loss, tampering, and breaches of user privacy.

This is the first research of its kind at this scale – no one has ever published even approximate findings on Apple’s secret leaks before. These findings raise a bigger question: is Apple’s App Store security review failing to catch these weak spots? 

With stolen credentials linked to 31% of all breaches and an increasing reliance on mobile devices for sensitive transactions, this is a problem that app users and developers must address.

For more details, including a look at the most sensitive leaked secrets, read the full article here.

Apple’s App Store is considered the gold standard for security, but Cybernews researchers analyzed 156,080 randomly selected iOS apps – around 8% of the apps present on the App Store – and uncovered a massive oversight: 71% of them expose sensitive data, including API keys, cloud storage credentials, and financial information.

The security of iOS apps remains under-researched, and this is the first research of this kind at scale. 

Key findings of this research:

• Over 816,000 secrets were found, with an average of 5.23 exposed secrets per app.
• Out of 94,240 storage bucket instances found hardcoded in iOS applications (with some apps containing multiple storage bucket endpoints), 836 of these endpoints (0.89%) were accessible without authentication, exposing 406TB of user files, personal data, and documents.
  • If you were to stream HD video, 406TB would allow you to watch for approximately 17 years of non-stop HD content.
• 2,218 Firebase instances (4.34%) had misconfigured authentication, leaking 19.8 million records (33GB of data), including user session tokens and backend analytics, almost all of these instances hosted in the US.
  • This is the equivalent of 16 million photos from an iPhone.
• More than 51,000 apps misuse Google’s Firebase database, making user data vulnerable to easy theft.
  • That’s more than the number of Starbucks locations worldwide – each one representing an app where sensitive data is at risk.

Potential consequences: 

• Mass-scale exploitation: attackers can rapidly scan millions of apps, compromising multiple companies – including major multinationals with billions of users – in a short time.
• User tracking and service manipulation – thousands of leaked security keys could allow hackers to track users, alter app functionality, or disrupt services.
• Financial and data theft: some leaks are severe enough to let attackers make unauthorized payments, issue refunds, or access private messages.

Methodology

The researchers analyzed iOS app versions available from October 2-16, 2024 using OSINT and Reverse Engineering techniques. Without de-obfuscating or decompiling, researchers found a massive number of plaintext secrets stored in IPA archives. They also examined cloud bucket and Firebase endpoints for authentication gaps. The research was conducted between July 2024 – January 2025.

What are hardcoded secrets? 

They are sensitive pieces of information – like passwords, API keys, or encryption keys – that are embedded directly into an app’s code instead of being stored securely. This makes them easy for hackers to find and exploit, potentially leading to data breaches, unauthorized access, and financial fraud.

Why this matters:

• Consumer impact – this affects everyday iPhone users who trust Apple to keep their data safe.
• Corporate accountability – Apple’s reputation is built on security – how did this massive oversight happen?
• National security risks – with a lot of the exposed data hosted in the US, the implications go beyond individual users to businesses and even government entities.

Please find the full Cybernews research article here. 

By Vincentas Baubonis, Head of Security Research at Cybernews

The recent discovery of a backdoor in the Contec CMS8000 patient monitor – revealed by CISA – should be a wake-up call for anyone in the cybersecurity or healthcare sectors. This is not a rare, isolated issue. 

A report by the US Government Accountability Office (GAO) highlighted that, as of January 2022, 53% of connected medical devices and other Internet of Things devices in hospitals had known critical vulnerabilities, emphasizing the widespread nature of this problem. 

These findings indicate that many of the devices we rely on in healthcare are very vulnerable. Specifically, the CMS8000 backdoor allows remote access, potentially enabling attackers to manipulate vital signs monitoring or leak sensitive patient data without detection. And as terrifying as this case is, it’s just one example of a much broader, deeply ingrained problem.

Let’s talk numbers. According to the Cybernews Business Digital Index, the healthcare industry is performing terribly when it comes to cybersecurity. A full 22% of analyzed healthcare companies scored a D in security, and nearly half – 48% – earned an F. Only 5% of the sector’s organizations reached an A. With an average security score of just 69, healthcare comes in dead last when it comes to cybersecurity. That should make everyone in this field sit up and take notice.

The reality is, medical devices like the Contec CMS8000 aren’t being designed with the security they require. With more and more devices connecting to the internet and sharing sensitive data, this is a ticking time bomb. Healthcare organizations are failing to enforce the most basic security measures. In the worst cases, manufacturers are shipping devices with poorly coded firmware that’s vulnerable to remote manipulation – leaving hospitals, doctors, and patients exposed. Devices bought by critical sectors should be evaluated technically before acquisition and potential risks associated with them must be managed and mitigated by the buyer.

Medical devices like the Contec CMS8000 often lack essential security features, making them vulnerable to cyber threats. As more devices connect to the internet and handle sensitive patient data, the risks increase significantly. Reports from regulatory agencies, including the FDA and CISA, have repeatedly highlighted security flaws in medical devices, including vulnerabilities that allow remote access and data exposure. 

In some cases, manufacturers ship devices with outdated or insecure firmware, exposing healthcare providers and patients to potential cyberattacks. To mitigate these risks, healthcare organizations must enforce stricter security evaluations before procurement, ensuring that all devices meet established cybersecurity standards and that identified vulnerabilities are promptly addressed.

Medical devices need to be treated with the same rigor as any other critical infrastructure. But far too often, the focus is on getting the device to market quickly, not securing it properly. This oversight has immediate consequences: data breaches, privacy violations, and, in the worst cases, loss of life.

So, what needs to happen now? First and foremost, cybersecurity must be baked into the design and testing of every medical device. Manufacturers must adopt a security-first mindset, regularly updating their devices and using secure coding practices to eliminate these vulnerabilities before they hit the market. Healthcare providers, too, must take ownership by ensuring their networks are secure and implementing strong access controls on all connected devices.

This is not a problem that can be solved with band-aid fixes. It’s time for a fundamental shift. If the healthcare industry doesn’t start prioritizing cybersecurity across the board, incidents like the CMS8000 backdoor will continue to be just the tip of the iceberg, especially against the backdrop of rising state-backed cyberattacks.

ABOUT THE EXPERT

Vincentas Baubonis is an expert in Full-Stack Software Development and Web App Security, with a specialized focus on identifying and mitigating critical vulnerabilities in IoT, hardware hacking, and organizational penetration testing. As Head of Security Research at Cybernews, he leads a team that has uncovered significant privacy and security issues affecting high-profile organizations and platforms such as NASA, Google Play, and PayPal. Under his leadership, the Cybernews team conducts over 7,000 pieces of research annually, publishing more than 600 studies each year that provide consumers and businesses with actionable insights on data security risks. 

By Aras Nazarovas

The recent AI summit in Paris pushed an optimistic vision of the technology’s potential, focusing on how AI can solve big problems in medicine, climate science, and beyond instead of prioritizing security. But the world can’t just be blissfully excited. It’s crucial to remember that AI is also a powerful tool for malicious actors – one that’s already being used in cyberattacks and could evolve into a much bigger threat.

Today, AI is being deployed to amplify cyberattacks in various ways. A study from the University of Cambridge showed how AI-driven cyberattacks are becoming more sophisticated. Attackers are increasingly using machine learning algorithms to automate phishing attacks, targeting individuals and organizations with highly personalized content. These AI-driven systems can analyze vast amounts of data – on social media profiles, browsing history, and even email patterns – to create convincing attacks that are harder to detect than traditional ones. 

AI tools lower the barrier to entry for cybercrime by enabling less experienced attackers to launch attacks they wouldn’t otherwise have the skills or knowledge to carry out. For instance, individuals who lack programming skills, can now simply ask AI tools like ChatGPT to write bots that automate the process of breaching servers. While these attacks may not be novel, they still increase the volume of potential threats companies need to defend against, draining the resources of already underfunded security teams. 

Striking the Right Balance Between Innovation and Security 

As AI tools become more embedded in business operations, the stakes grow even higher. For instance, KPMG’s recent survey of financial leaders revealed that 84% plan to increase their investments in generative AI (GenAI). 

While they and presumably other industries are in the process of accelerating  the adoption of AI tools, the World Economic Forum reports that nearly 47% of surveyed organizations have already noticed adversarial advances powered by GenAI as their primary concern, enabling more sophisticated and scalable attacks. Moreover, the same report states that only 37% of organizations have processes in place to assess the security of AI tools before deployment. 

Meanwhile, the EU’s AI Act, which aims to regulate high-risk AI systems, is being phased in over several years, with full implementation not expected until 2027. However, there is a growing debate in Europe about how to balance regulation with fostering innovation. During the Paris AI summit, French President Emmanuel Macron remarked that Europe might reduce regulatory burdens to allow AI to flourish in the region. 

This presents a potential challenge: while Europe struggles with over-regulation concerns, its wait-and-see approach might cause them to miss the boat as AI technology evolves at an incredible speed. By the time the AI Act is fully in place, we could be facing an entirely new wave of AI-powered cyberattacks, many beyond the scope of current regulations. 

So, what does this mean for cybersecurity if AI is regulated by a light-touch regulatory framework? While innovation is essential, the absence of security-focused regulation means AI tools are already in the hands of cybercriminals who can weaponize them with minimal oversight.

At the moment, the capacity of AI systems for automating and optimizing cyberattacks already extends far beyond aforementioned phishing. AI-powered tools can be used to exploit vulnerabilities in critical infrastructure systems, launch bigger Distributed Denial of Service (DDoS) attacks, or even manipulate financial markets. In 2023, the US Department of Homeland Security issued a warning that AI-powered systems could soon be capable of launching autonomous cyberattacks that are difficult to counteract using conventional defense mechanisms. Such threats present a security nightmare that policymakers can’t afford to ignore.

If AI systems evolve to the point where they can autonomously compromise digital infrastructure, we could see an escalation in both the frequency and severity of cyberattacks, potentially crippling global systems.

Cybersecurity Must Evolve – Now

Whether AI is robustly regulated or not, businesses should do more than a bare minimum for cybersecurity. First, it’s essential to invest in additional, AI-driven security tools rather than replacing existing ones with AI-powered solutions. While AI and machine learning can be incredibly useful for detecting and preventing attacks in real time, they can also make incorrect decisions. AI should serve as an additional resource to enhance cybersecurity efforts, not as a replacement for traditional tools. By analyzing patterns in network traffic, AI can identify anomalies that may signal a breach. As cyberattacks become more automated, AI can help security teams identify threats faster and more efficiently, allowing them to do more with the same amount of resources.

Another step is to start incorporating AI threat modeling into security protocols. AI can be leveraged to predict and prevent attacks. Security teams need to think like attackers, using AI to simulate how their systems might be breached and proactively patching those vulnerabilities before they can be exploited.

Finally, companies must invest in continuous training for their security teams. As AI-driven attacks evolve, it’s not enough to simply rely on firewalls and antivirus software. Security professionals need to be prepared to deal with more sophisticated, AI-powered threats. This includes staying ahead of trends, understanding how AI tools are being used against them, and developing strategies that go beyond traditional defenses.

Undoubtedly, AI has the potential to revolutionize cybersecurity and every other industry, but it also introduces a new wave of risks. While policymakers may be caught up in the AI race, cybersecurity professionals must act now. AI can be an ally in the fight against cybercrime and in enabling business operations, but it can also become an adversary if left unchecked. As we race toward a future shaped by AI, securing our systems against its darker side should be a top priority.

ABOUT THE EXPERT

Aras Nazarovas is an Information Security Researcher at Cybernews, a research-driven online publication. Aras specializes in cybersecurity and threat analysis. He investigates online services, malicious campaigns, and hardware security while compiling data on the most prevalent cybersecurity threats. Aras along with the Cybernews research team have uncovered significant online privacy and security issues impacting organizations and platforms such as NASA, Google Play, and PayPal. The Cybernews research team conducts over 7,000 investigations and publishes more than 600 studies annually, helping consumers and businesses better understand and mitigate data security risks. 

Previous Cybernews research: 

1. Recently, Bob Dyachenko, a cybersecurity researcher and owner of SecurityDiscovery.com, and the Cybernews security research team discovered an unprotected Elasticsearch index, which contained a wide range of sensitive personal details related to the entire population of Georgia. 
2. The team analyzed the new Pixel 9 Pro XL smartphone’s web traffic, and found that Google’s latest flagship smartphone frequently transmits private user data to the tech giant before any app is installed.
3. The team revealed that a massive data leak at MC2 Data, a background check firm, affects one-third of the US population.
4. The Cybernews security research team discovered that 50 most popular Android apps require 11 dangerous permissions on average.
5. They revealed that two online PDF makers leaked tens of thousands of user documents, including passports, driving licenses, certificates, and other personal information uploaded by users.
6. An analysis by Cybernews research discovered over a million publicly exposed secrets from over 58 thousand websites’ exposed environment (.env) files.
7. The team revealed that Australia’s football governing body, Football Australia, has leaked secret keys potentially opening access to 127 buckets of data, including ticket buyers’ personal data and players’ contracts and documents.
8. The Cybernews research team, in collaboration with cybersecurity researcher Bob Dyachenko, discovered a massive data leak containing information from numerous past breaches, comprising 12 terabytes of data and spanning over 26 billion records.
9. The team analyzed NASA’s website, and discovered an open redirect vulnerability plaguing NASA’s Astrobiology website.
10. The team investigated 30,000 Android Apps, and discovered that over half of them are leaking secrets that could have huge repercussions for both app developers and their customers.