VR porn app hack exposed 20,000 randy viewers’ names and download habits, but creators say ‘all back-door intrusions are fully consensual’ now
The personal data included names and e-mail addresses, but the app's owners insist the security flaw has been completely patched up
VIRTUAL reality porn users have had their naughty habits exposed by "ethical" hackers.
The stolen information included personal info like names, e-mail addresses, and even porn download details of randy SinVR users.
The major leak was revealed by Digital Interruption, a cybersecurity company that cracked porn app SinVR's systems to help protect users.
SinVR is saucy VR porn game that lets users interact with horned-up characters in a digital 360-degree environment.
Once Digital Interruption had broken through SinVR's security systems, it warned the company about the flaw to prevent real hackers gaining access.
In a blog post, white-hat hacker Jahmel wrote: "Not only could an attacker use this to perform social engineering attacks, but due to the nature of the application, it is potentially quite embarrassing to have details like this leaked."
"It is not outside the realm of possibility that some users could be blackmailed with this information."
The hackers were able to gain access to private information for 20,000 users, prompting them to warn SinVR in December.
SinVR's creators have since fixed the issue, and told The Sun that they were thankful for Digital Interruption's "ample warning".
"We fixed the issue as soon as it was revealed to us."
"Altogether, it has been a tremendous learning experience, which will serve to enhance our security and we are glad that it was conducted ethically."
"Moving forward, we are confident in our ability to stop similar attacks and will keep using a professional security service to audit our system."
"We are making sure that all 'back door' intrusions are fully consensual."
Digital Interruption issued another warning yesterday however, saying that they had found even more problems with SinVR's systems.
"Looks like SinVR has fixed the vulnerability we raised that exposed thousands of user details."
"If they'd like to get in touch with us, we'd like to share details about some other vulns [vulnerabilities] we found," wrote the cybersecurity firm.
We spoke to SinVR, who told us that these additional issues have also been resolved – and confirming that no user data was at risk.
"We gave them permission to dig father, but these issues are not related to user data, which is all blocked now."
"They are talking about ways to play they game without paying."