Mitron App, an Emerging TikTok Alternative, Said to Have Vulnerability That Puts User Accounts at Risk

Mitron app, which was launched as an alternative to TikTok and has gained notable popularity in a short time, allegedly has a vulnerability that could allow an attacker to compromise user accounts and send messages on behalf of a specific user. The flaw doesn't allow any bad actor to steal personal information such as the email ID that a user has used to sign up an account on the Mitron app. However, it can be exploited to gain access to the profile of the affected user. The Mitron app is so far exclusive to Android and has reached over 50 lakh downloads on Google Play.

By exploiting the vulnerability of theMitron app, an attacker could send messages to other users and even follow other people or comment on behalf of the victim, cyber-security researcher Rahul Kankrale told Gadgets 360. He said the issue exists within the login process of the app that allows bad actors to intercept and gain the unique user ID of the victim that can be used to log in to their accounts — without requiring any passwords or an additional verification.

Kankrale also mentioned that the developer of theMitronapp isn't using the Secure Sockets Layer (SSL) protocol to secure the login. Although the app does allow users to login with their existing Google accounts, it processes the login through the unique user ID instead of using the provided Google account, he added.

He has alsomade a videoshowing the scope of the vulnerability that is yet to be fixed. Heinitially informedsecurity-focussed site The Hacker News about the vulnerability.

Gadgets 360 didn't elicit a response from the email address provided on theGoogle Playlisting of the Mitron app to get clarity on the flaw.

The Mitron app came intolimelight as an India-made solutionto counterTikTok. Some reports claimed that it was made by a student of IIT Roorkee. However, on Friday, it was reported that the app is not made in India andbrought from a Pakistani software developer firm Qboxus.

Gadgets 360 doesn't recommend anyone to install and use the app that doesn't have any clarity about its makers and has at least one major vulnerability that is yet to be fixed.

Is Realme TV the best TV under Rs. 15,000 in India? We discussed this onOrbital, our weekly technology podcast, which you can subscribe to viaApple PodcastsorRSS,download the episode, or just hit the play button below.