The Sarahah app basically exploded in a matter of weeks. With more than 18 million downloads around the world, its users seem to be enjoying the possibility of sharing "anonymous feedback", but beyond the supposed entertainment, the software has a dark side. Security researcher Zachary Julian discovered that Sarahah uploads to the web all the phone numbers from contacts and email addresses. Its behavior was verified on iOS and Android, but the app's creator reported that the extraction is associated with an abandoned feature, which was never completely deactivated…
In recent days I've seen several of my contacts posting screenshots with the "criticisms" they receive through the Sarahah app. Besides not being very impressed (the app has multiple performance and stability problems), everything I've read so far suggests that courtesy is actually an exercise in hypocrisy. However, there is another even more serious aspect to this software, and that is that it loves collecting private information from the user. When an app gains popularity, different security experts decide to analyze its behavior, and what researcher Zachary Julian discovered is not very pretty, to say the least…
How Sarahah Uploads Your Contacts
Julian prepared a Samsung Galaxy S5 smartphone with Android Lollipop 5.1.1 and the Burp Suite monitoring software, which intercepts traffic on the device (incoming and outgoing). With the help of Burp Suite, he confirmed that Sarahah uploads to the web all the contacts and email addresses of the user. On more modern versions of Android and later iOS builds, the app requests permission to "access contacts", but in most cases, the upload is performed without warning. As if that weren't enough, Julian discovered that if the user doesn't open the app for a while (less than 48 hours), Sarahah sends the contacts again.
Sarahah's Response
The specialized press tried to talk to those responsible for Sarahah, and after a brief silence, its creator Zain al-Abidin Tawfiq communicated via Twitter that the reading of contacts will be removed in a future build, and that it had been intended for the introduction of a feature that would allow "find your friends". Apparently, that feature suffered "multiple technical problems", and the partner tasked with removing it from the app (who, by the way, no longer works at Sarahah) never did. At the same time, the feature was purged on the server, and its databases don't store any contacts. Of course, this statement is impossible to verify without a total openness of Sarahah's code and the corresponding audit. Anyone who decides to keep using Sarahah after such a discovery should abandon the mobile app and use its website.
