Multiple efforts by The Security Ledger to contact inVR Inc. have fallen flat, including messages sent by email, Twitter and on Reddit forums where the company is active. More than one effort to reach out to the parent company, InVR Inc. However, contacting the firm has proven challenging. NET library, was simple to reverse engineer and analyze. He said the application, which relied on a Microsoft. And, because no authentication is required, it would be possible for any SinVR user to download all customer records, Harris said.

The function was not accessible from the SinVR application, but by studying how the SinVR web API (application program interface) worked, Harris was able to trigger it manually. Passwords and credit card details were not part of the data dump, Harris said. That function called a web service that downloaded thousands of SinVR customer records including email addresses, user names, computer PC names and so on. The group discovered the hole after reverse-engineering the SinVR desktop application and noticing a function named “downloadallcustomers“. Researchers at Digital Interruption, a penetration testing firm based in Birmingham, UK, made a survey of various adult themed applications and decided that the SinVR application looked like the most fruitful ground to explore. This includes names and e-mail addresses. The function permits users to download every customer in the database along with other pieces of personal information. Security researchers in the UK have uncovered a function in the game SinVR. It may be comparatively small, but the potential embarrassment could be pretty big. This time, it may leave some customers red-faced as an adult VR game is found to be leaking personal information.

Sinvr reddit