The Go SMS Pro messaging app is no longer available on Google Play
Go SMS Pro, a popular messaging app for Android devices, has been withdrawn from Google Play. The new development comes just hours after a serious vulnerability in the app was reported that could allow anyone to access photos, videos and other files privately sent by their users. Go SMS Pro developers were informed about the flaw in August. However, it has not been clarified if it has still been patched. The app had more than 100 million downloads from Google Play prior to its removal.
Security researchers from Singapore cybersecurity firm Trust wave discovered the flaw in Go SMS Pro that publicly exposes media files transferred between its users. The application allows users to send multimedia files like photos and videos to others, just like any other messaging application. If the recipient does not have Go SMS Pro installed on their devices, the media file is shared with them as a URL via normal SMS. This link allows the recipient to view the media file through a web browser.
Researchers, like reported By TechCrunch, he found that the links sent through Go SMS Pro were sequential and could be predicted by someone who knows how to generate links. This means that a bad actor could access the files shared by any Go SMS Pro user simply by changing some parts of the URL generated by the application.
Trustwave researchers found the issue particularly in Go SMS Pro version 7.91, although they mentioned in a blog post that it was still in place. TechCrunch’s Zack Whittaker mentioned in his report that after looking at a few dozen links, he saw a person’s phone number, a screenshot of a wire transfer, and an order confirmation that included a person’s home address, among others. details.
Trust wave researchers contacted the creator of Go SMS Pro, GOMO Apps, shortly after they discovered the flaw in August. However, the Guangzhou-based company did not respond and confirmed whether the problem was fixed.
TechCrunch reported that it attempted to contact the manufacturer of Go SMS Pro by sending an email to two addresses connected to the application. However, an email sent to an address was recovered with a message that the inbox was full, while another email was received but not responded to and a follow-up was not even opened.