“In addition, the connection string to this Azure cosmos database is accessible within the Decompilation of the application itself and therefore is disclosed.”
Kekz sells offline kids’ headphones whose “encryption” is a round-robin XOR, and a phone can clone the story chips. The Windows app uploads track metadata and Wi-Fi geolocation to an Azure database whose credentials ship inside the app. The researcher emailed the CTO in October 2023 and the CEOs in February 2024 and never heard back. Kekz answered by changing its privacy policy.