Security Vulnerability in 'Call Recorder' App Exposed User Conversations

Tuesday March 9, 2021 11:06 am PST by Juli Clover

A security flaw in an app called "Call Recorder" exposed thousands of customer conversations, reports TechCrunch. The vulnerability was found by PingSafe AI researcher Anand Prakesh, and has since been patched.

The Call Recorder app is designed to allow iPhone users to record their incoming and outgoing phone calls, with those recordings stored in the cloud on Amazon Web Services.

Using a proxy tool like Burp Suite, Prakash was able to view and modify network traffic going in and out of the app, and when replacing his phone number with the phone number of another Call Recorder user, their recordings became available on his phone.

There were more than 130,000 audio recordings available, though the files could not be accessed or downloaded outside of the app. TechCrunch informed the developer about the security flaw and it was fixed in an update on Saturday.

A recent report from mobile security firm Zimperium suggested that thousands of iOS apps that use public cloud services like Amazon Web Services, Google Cloud, and Microsoft Azure have improper setups that risk exposing user data.

6,608 iOS apps were found to be exposing users' personal information, passwords, and medical information. Zimperium CEO Shridhar Mittal said that cloud storage misconfigurations are a "disturbing trend."

"A lot of these apps have cloud storage that was not configured properly by the developer or whoever set things up and, because of that, data is visible to just about anyone. And most of us have some of these apps right now," he said.

No apps were named in the report because of the vulnerabilities involved, but some were major apps including a mobile wallet from a Fortune 500 company and a transportation app from a large city.

Tags: App Store, AWS

Popular Stories

Apple Plans to Squeeze More Revenue From the App Store, Report Says

Monday September 7, 2026 3:19 am PDT by Tim Hardwick

Apple is looking at further ways to monetize the App Store and increase the company's recurring revenue from the platform, according to a new report. Writing in his latest Power On newsletter, Bloomberg's Mark Gurman said that newly appointed Apple CEO John Ternus and services chief Eddy Cue are behind the effort to raise margins from the App Store, which already generates Apple an estimated ...

• 176 comments

X's Standalone Messaging App XChat Disappears From App Store

Monday September 14, 2026 3:25 pm PDT by Juli Clover

X's XChat app is no longer available from the App Store. The app does not come up when searching for it in the App Store, and clicking a link to it on the web returns an unavailable error. XChat allows X users to communicate with one another using end-to-end encryption and disappearing messages. The app's description says it is a "private, focused space built for conversation." XChat launched...

• 28 comments

Apple Asks Supreme Court to Throw Out App Store Contempt Ruling

Monday September 14, 2026 4:28 pm PDT by Juli Clover

Apple today filed its opening merits brief with the Supreme Court as it prepares to fight the contempt ruling that forced it to change its App Store rules. Apple is asking the Supreme Court to reverse or vacate the contempt order, which would return the App Store to its pre–2025 rules. The Supreme Court filing is part of Apple's ongoing legal battle with Epic Games, which has gotten more...

• 65 comments

Top Rated Comments

Rigby

73 months ago

Anything goes in the walled garden as long as Apple gets its pound of flesh.

Remember when they said it was going to be curated?

If you expected Apple to be able to somehow detect every bug or vulnerability in every 3rd party app, you have completely unrealistic expectations.

You're safer using the open Web, thanks to the protections of Google.

Thanks for the laugh.

Score: 9 Votes (Like | Disagree)

MichaelMaier

73 months ago

I always wonder why people need to record a phone call, since without consent it can’t be used as evidence in a trial and might ilegal in US…… until someone from Instacart’s customer support told me to “get over it” and accept that they spy their customers but is not different from anyone else. I was like….but I’m paying for your to spy on me? And they said yes! …. I wish I have a way to record those calls.

Correct me if I’m wrong, but in most US states you only need the consent from one participant of a recorded conversation.

Score: 5 Votes (Like | Disagree)

deevey

73 months ago

I always wonder why people need to record a phone call, since without consent it can’t be used as evidence in a trial and might ilegal in US…… until someone from Instacart’s customer support told me to “get over it” and accept that they spy their customers but is not different from anyone else. I was like….but I’m paying for your to spy on me? And they said yes! …. I wish I have a way to record those calls.

Try calling any customer service dept multiple times. Half the time they deny having a log of the previous complaints or fail to relay the call correctly.

Being able to play the call back to their supervisor - priceless !

Score: 4 Votes (Like | Disagree)

69Mustang

73 months ago

I always wonder why people need to record a phone call, since without consent it can’t be used as evidence in a trial and might ilegal in US…… until someone from Instacart’s customer support told me to “get over it” and accept that they spy their customers but is not different from anyone else. I was like….but I’m paying for your to spy on me? And they said yes! …. I wish I have a way to record those calls.

The laws in the US vary by state and jurisdiction. Some have 2 party consent, others only require 1 party. You are right that with consent, the recording can be used as evidence in court. I live in a 1 party consent state. Fyi, 37 other states and the District of Columbia are also 1 party consent.

With that knowledge in hand, it's not really that hard to fathom why people record calls.

Score: 4 Votes (Like | Disagree)

Apple_Robert

73 months ago

Anything goes in the walled garden as long as Apple gets its pound of flesh.

Remember when they said it was going to be curated?

You're safer using the open Web, thanks to the protections of Google.

If you use Safari Fraudulent Website Warning (which you probably do by default), that's a Google feature (Apple sends the URLs to Google's servers to check them).

None of this makes Apple look good in its antitrust hearings where they say consumers trust them to have a safe app store and thus can't allow third party app stores or payment services.

How is the subject of the article Apple's fault?

Score: 3 Votes (Like | Disagree)