Jio Does Not Seem to Understand What Passwords Are For, and Now Private Data Has Been Exposed

Everyone is trying to help the fight against the nasty coronavirus, and tech companies are no exception, especially the ones that have large userbases. Reliance Joi, one of India's biggest telecommunications providers, for example, recently launched what it called a 'Symptom Checker.' Having seen the tool, we should probably point out that the name Jio has chosen might be a bit optimistic.

If you think that the tool will somehow check your symptoms and determine whether or not you've got COVID-19, you'd be disappointed. In essence, Jio's Symptom Checker is a series of multiple-choice questions. Based on your answers, an algorithm determines whether you're at low, medium, or high risk of catching the disease, and it gives you the appropriate advice. You can create an account and "track" your symptoms, but that's about it when it comes to features.

Mind you, it's not a waste of time. In addition to telling you how big the risk is, the Symptom Checker also gives you a number of resources that can be extremely helpful, especially given the numerous fake news and misinformation campaigns surrounding the pandemic. You should be aware of the fact, however, that an online tool can't tell you whether or not your runny nose was caused by the common cold or the coronavirus. Those of you who use Joi's Symptom Checker should know that some of the data you enter is being recorded.

Jio's Symptom Checker saves some of the information users enter

Each and every test is carefully logged. For the most part, the information that is kept is limited to gender, age, and whether you're providing your own answers or are answering on behalf of a friend or a relative. Information on the user's operating system and browser version is also recorded and stored, and, if allowed, the Symptom Checker can record the user's precise location. As you might imagine, the logs are even more detailed for registered users. Jio's Symptom Checker doesn't seem to record any personally identifiable information, but we're pretty sure that at least some of you are wondering what it needs these details for.

The truth is, service providers need to keep tabs on who uses their products and how, and there's little doubt in anyone's mind that usage statistics help developers introduce performance optimizations and new features.

The question here is whether the above-listed data points all fit in the term "usage statistics," and we're pretty sure that there are people who would argue that they don't. Jio's case for logging all that data isn't helped by the fact that users aren't explicitly warned about it.

Jio put user data at risk by leaving it in a wide-open database

You may be wondering how we know all this, and unfortunately, the answer is the most disappointing detail about the whole story. On May 1, security researcher Anurag Sen, the same person who uncovered the Paay leak a couple of weeks ago, located a database which, a closer inspection revealed, belonged to Jio. Peeking inside, Sen found millions of records that have been logged by the Symptom Checker, with some of them dating back to April 17.

It turned out to be a production server, and the records of more people using the tool were being added in real time. Worst of all, because it wasn't protected by a password, the data was accessible from anywhere in the world. Anurag Sen immediately contacted TechCrunch's Zack Whittaker, who informed Jio about the leak, and the database was soon pulled offline. A spokesperson for the telecommunications provider told Whittaker that Sen accidentally stumbled upon one of the company's "logging servers," which was helping them monitor the performance of the website. What Jio didn't say was why it was left without a password.

As is usual with this kind of leaks, saying whether cybercriminals managed to get to the data before it was taken down is not really possible. In this case, the exposed information doesn't appear to be that sensitive, but unfortunately, the incident proves for the umpteenth time that the people responsible for storing users' data don't always do a very good job.