Tea App Breach Exposed 72,000 Selfies & IDs: Urgent Lessons for Mobile API Security

https://is1-ssl.mzstatic.com/image/thumb/Podcasts211/v4/60/d9/f3/60d9f3b7-c2e2-5976-0efb-35fe6d08fff7/mza_5533681006261142495.jpg/600x600bb.jpg

Upwardly Mobile - API & App Security News

Approov Mobile Security

101 episodes

2 days ago

Dive into the high-stakes world of mobile app development and API security with Upwardly Mobile, your ultimate guide to defending apps in today’s volatile digital landscape. Hosted by Skye Macintyre and George McGregor, and proudly sponsored by Approov, the gold standard in mobile app attestation and API security. This podcast unpacks the evolving AI enabled threats and innovative solutions shaping mobile cybersecurity. Explore why built-in protection from Apple, Google, Samsung and Huawei often fall short, leaving sensitive data vulnerable. Learn how advanced techniques—like runtime attestation and dynamic API security—thwart attackers and secure your app ecosystem. Each episode delivers insights into major data breaches, emerging trends, and actionable strategies to fortify your apps and APIs against ever-advancing cyber threats. From development best practices to navigating compliance and regulation, Upwardly Mobile equips iOS, Android and HarmonyOS mobile developers, security professionals, and tech enthusiasts with the knowledge to safeguard their creations. Stay informed, stay secure, and stay ahead with expert guidance on the future of mobile cybersecurity. Subscribe now on Spotify and Apple Podcasts, and elevate your security game!

All content for Upwardly Mobile - API & App Security News is the property of Approov Mobile Security and is served directly from their servers with no modification, redirects, or rehosting. The podcast is not affiliated with or endorsed by Podjoint in any way.

Tea App Breach Exposed 72,000 Selfies & IDs: Urgent Lessons for Mobile API Security

Upwardly Mobile - API & App Security News

19 minutes

3 months ago

Tea App Breach Exposed 72,000 Selfies & IDs: Urgent Lessons for Mobile API Security

Mobile-First Security: The Urgent Lessons from the Tea App Breach

In this focused segment of Upwardly Mobile, we unpack the recent Tea app breach, a sobering case study that highlights the critical need for a robust mobile-first cybersecurity strategy and proper API security. The Tea app, a women's dating safety application that rapidly climbed to the top of the free iOS App Store listings and reached the No. 1 spot on Apple's US App Store, claiming over 1.6 million users, was designed to allow women to exchange information about men to enhance safety. A key feature involved new users verifying their identity by uploading a selfie. The company confirmed a major security breach, stating they had "identified authorized access to one of our systems". Preliminary findings revealed access to approximately 72,000 user images. This alarming exposure included:

13,000 images of selfies and photo identification documents, such as driver's licenses, which users had submitted during the account verification process.
59,000 publicly viewable images from posts, comments, and direct messages within the app.

The exposed images reportedly originated from a "legacy data system" that held information from more than two years prior. Posts on Reddit and 404 Media indicated that these sensitive user images, including faces and IDs, were posted on the anonymous online messageboard 4chan, with one post explicitly stating, "DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN!" and highlighting "No authentication, no nothing. It's a public bucket". Users from 4chan claimed to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, as the source of the vulnerability. According to Ted Miracco, Chief Executive Officer of Approov Limited, the Tea app breach is a stark example of a "systemic failure in API security". He attributes this failure to several critical oversights:

Broken access controls. (BOLA)
Weak authentication.
Missing transport protections.
Absent runtime safeguards.

Miracco emphasizes that such failures are "not inevitable" but are "preventable with disciplined engineering, proper API defenses, and a real commitment to protecting user trust". This incident highlights a common pitfall where companies "rush apps to market, driven by subscriber growth and churn metrics, while privacy and security are sidelined". The broader lesson from the Tea app breach underscores how mobile apps introduce significant risk to an organization's back-end services. Mobile apps serve as a "front door to the back end," and a mobile device effectively holds "the secret key to the front door" – the key to server-side APIs. The increasing reliance on numerous server-side APIs accessed via mobile devices creates growing security exposure, especially since many APIs are often not adequately protected. Shockingly, up to half of APIs may lack basic usernames and passwords, and their access keys can be easily stolen from various locations, including mobile device files, server-side files, or even decompiled application source code. Hackers, by gaining control over their own devices, can easily reverse engineer apps and steal crucial API keys, which then allow them to build scripts to attack back-end corporate services undetected. Failing to protect API keys is likened to "putting all your money in a safe place in the home but not locking the front door". This breach serves as a powerful reminder that organizations must prioritize mobile security as a central component of their cybersecurity strategy, rather than an afterthought.