Page 5 - Test Partners News Today : Breaking News, Live Updates & Top Stories | Vimarsana

Peloton API Exposed User Data, Even for Private Accounts Photo: Scott Heins/Stringer (Getty Images) Peloton’s had a rough go in the news cycle lately, and not helping matters is the fact that its leaky API allowed any hacker to obtain any user’s account data—even if that user had set their profile to private. Advertisement The vulnerability, which was discovered by security research firm Pen Test Partners, allowed requests go through for Peloton user account data without checking to make sure the request was authenticated. The API itself is the bit of software that allows the Peloton ha...

minute read Share this article: On top of the privacy spill, Peloton is also recalling all treadmills after the equipment was linked to 70 injuries and the death of one child. Peloton has hit a pothole. Its API was leaking riders’ private data, it ignored a vulnerability disclosure from a penetration testing company, and it partially fixed the hole but didn’t get around to telling the researcher until he reached out to a cybersecurity journalist for some help. This is bad news for Peloton, coming just before other, far more horrific news hit the headlines: Namely, on Wednesd...

Writing in a blog post, Pen Test Partners also said the flaw meant that users’ precise location data, as well as personal information and private chats were leaked. The firm went on to explain that “the risk of personal data leakage seems more likely to be exploited and give reward to an attacker” than locking someone in their device. Pen Test Partners first learned of the flaw in April 2020, and, after contacting Qiui with the problem, received assurances that it would be fixed. On June 11, an updated version of the Qiui Cellmate app was uploaded to app stores, which “mostly resolved...