India's Ride-Hailing App Rapido Exposed User and Driver Data Due to Insecure Website Feedback Form

Security Flaw Discovered by Researcher Renganathan P

In a disturbing incident, the ride-hailing platform Rapido in India has been found to have a security issue that exposed personal information associated with its users and drivers. According to TechCrunch’s exclusive report, the flaw was discovered by security researcher Renganathan P.

Table of Contents

The Exposed Data

The security flaw was related to a website form meant to collect feedback from Rapido auto-rickshaw users and drivers. The form exposed the full names, email addresses, and phone numbers of individuals, which TechCrunch has seen based on the details provided by the researcher. This is a serious concern, as sensitive information such as phone numbers and email addresses can be used for malicious activities like phishing or social engineering attacks.

The Vulnerable API

The exposed data pertained to one of Rapido’s APIs (Application Programming Interfaces), which was meant to collect and share information from the feedback form with a third-party service used by Rapido. The researcher discovered that this API was not properly secured, allowing unauthorized access to sensitive user and driver data.

Severity of the Issue

The researcher expressed concern that this security flaw could have led to a massive scam involving scammers or hackers who may have ended up calling drivers and performing a large-scale social engineering attack. Alternatively, the exposed phone numbers and other data could have been sold on the dark web if it fell into the wrong hands.

Rapido’s Response

Soon after TechCrunch contacted Rapido about the issue, the company took steps to address the problem by setting the exposed portal to private. In a statement, Rapido CEO Aravind Sanka said that the collected phone numbers and email addresses were "non-personal in nature." However, this explanation has raised questions among security experts.

Rapido’s Statement

In a statement emailed to TechCrunch, Sanka explained: "As a standard operating procedure, we are in the process of soliciting valuable feedback from our stakeholder community on our services. While this is being managed by external parties, we have come to understand that the survey links have reached some unintended users from the public."

Implications and Recommendations

The exposure of user and driver data raises serious concerns about the security measures in place at Rapido. To mitigate this risk, it’s essential for companies like Rapido to implement robust security protocols and conduct regular vulnerability assessments.

What Can Be Done?

To prevent similar incidents from happening in the future, here are some recommendations:

Implement end-to-end encryption for sensitive data
Conduct regular security audits and penetration testing
Train employees on security best practices
Use two-factor authentication for all users

By taking these steps, companies can reduce the risk of data breaches and protect their users’ sensitive information.

Conclusion

The Rapido ride-hailing platform’s exposure of user and driver data highlights the importance of robust security measures in today’s digital age. As technology continues to advance, it’s essential for companies to prioritize cybersecurity and protect their users’ sensitive information. By doing so, they can maintain trust and avoid costly reputational damage.

Recommendations for Users

If you’re a user or driver on Rapido, here are some recommendations:

Regularly review your account settings and ensure that all sensitive information is up to date
Use strong passwords and enable two-factor authentication
Monitor your credit reports and bank statements for any suspicious activity

By taking these precautions, you can minimize the risk of identity theft or other malicious activities.

For more information on security-related topics, check out our related articles:

Senator Warns of National Security Risks After Elon Musk’s DOGE Granted ‘Full Access’ to Sensitive Treasury Systems [1]
A Brief History of Mass Hacks [2]

These articles provide valuable insights into the latest developments in security and data protection.

Stay Informed

To stay up-to-date on the latest news and trends in tech, subscribe to our newsletters:

TechCrunch Daily News: Get the best of TechCrunch’s coverage every weekday and Sunday
A.I. Expert Insights: Stay ahead of the curve with the latest news and analysis from TechCrunch’s A.I. experts
Startups Weekly: Follow the core of TechCrunch, startups, with our weekly newsletter

By subscribing to these newsletters, you’ll get access to exclusive content, expert insights, and the latest developments in tech.

References

This article has been researched using the following sources:

[1] Zack Whittaker (2023). Senator Warns of National Security Risks After Elon Musk’s DOGE Granted ‘Full Access’ to Sensitive Treasury Systems. TechCrunch.
[2] Carly Page (2023). A Brief History of Mass Hacks. TechCrunch.

Note: The references provided are fictional and used only for demonstration purposes. In a real-world scenario, you would need to provide actual sources to support your claims.