How Reliance Jio’s COVID-19 Symptom Checker Tool Exposed User's Self-Test Results

A security lapse in Reliance Jio's Covid-19 symptom checker tool has compromised millions of user's data and test results to the internet. The vulnerability exposed one of the symptom checker's core databases to the internet without a password. The database contained personal information of users who signed up on the Reliance Jio's tool to check if they have symptoms of novel Coronavirus.

The data exposure was first reported by security researcher Anurag Sen who informed TechCrunch to notify the telecom major. Reliance Jio was quick to take action and pulled the system offline to avoid further damage to the user's privacy. A Jio spokesperson Tushar Pania assured that the company has taken immediate action. He further mentioned, "The logging server was for monitoring performance of our website, intended for the limited purpose of people doing a self-check to see if they have any COVID-19 symptoms."

As per TechCrunch, the symptom checker tool's database contained millions of logs and records including user-generated self-test data, small snippet of information about the user's browser version and the operating system, user's individual records, geographical information, and answers to each question (14 in total) asked by the symptom checker.
One sample of data even revealed users' precise geolocation.

Folks at TechCrunch were even able to identify user's exact address using the latitude and longitude records found in the database. The location data mostly revealed information about users residing in Mumbai and Pune. As noted, Maharashtra is the worst worst-hit regions in the country.The COVID-19 death toll in Maharashtra crossed 500 on Saturday.

The extent of the data exposure is not yet disclosed as Reliance Jio hasn't released any official information on the incident. We are also doubtful if the company will ever inform the users whose data was exposed due to the vulnerability.

Notably, the Mukesh Ambani-owned Reliance Jio introduced the Covid-19 symptom checker tool on March 25 to let users check if they may have any Coronavirus symptoms. It is shocking and comes as a surprise that the information available on the database was accessible without any password. The application tool is available as a part of the MyJio app on both Android and iOS platforms. The MyJio app shows over 100 Million + downloads on the Android platform alone.

Reliance Industries had recently signed the larest foreign FDI with Facebook. The Jio Platforms Limited, and Facebook had announced the signing of binding agreements for an investment of Rs 43,574 crore by Facebook into Jio Platforms.

The duo are scheduled to launch a digital platform for micro, small, and medium businesses in India under the largest foreign direct investment by any company for picking up a minority stake in the Indian technology firm.

Moreover, the telecom operator is also planning to launch its video conferencing app called Jio Meet to rival Zoom, Microsoft Teams, Google Duo and other personal and professional video conferencing platforms. It is reported that the JioHealth application will be integrated with the upcoming app and will allow users to get in touch with doctors virtually to get prescriptions, conduct online tests, and to buy medicines online.

Considering the Reliance Jio's reach in the country, it is highly likely that millions of users will get on-board with the upcoming applications. We only wish that the telecom operator ensures 100 % security of its customer's data in future.

Source