Blisk is a web browser tailored for web developers keeping in view their needs. Launched in 2014, the browser’s userbase includes some prominent names as well, such as Apple, Microsoft, NASA, eBay, UNICEF and others.
Detailing their findings in a post, the researchers revealed that they found an unprotected Elasticsearch database leaking data. It precisely contained 3.4GB of data that included more than 2.9 million records. Blisk obtained this data from users without the need to bypass any security measures.
The exposed information included sensitive details about users, including their email addresses, user agent details, and IP addresses.
While leaving databases open is already negligent, the additional issue with Blisk was the way they collected the data. According to the researchers,
Since the browser “sees” what the user sees, it can potentially bypass encryption, 2-factor authentication, and any other measure they have in place. If the user is using software that is not heavily secured, this can lead to very serious security breaches. It appears that no matter what security measures you put in place while using Blisk, your data would still potentially be leaked.
Though the researchers fear that the kind of information left online could lead to serious security threats, Blisk confirmed to ZDNet that the incident did not affect any sensitive data.
Nonetheless, any Blisk user eager to know about the potential impact on oneself of the incident may contact the vendors for details.
