The Linuxfx project is a Linux-based system that reportedly runs Android applications alongside native GNU / Linux applications.
The project website also claims that there are over one million Linuxfx users in the world with over 15.000 downloads per week. It should come as no surprise that these allegations are not true.
One of the features of Linuxfx is an online registration and activation process, similar to that used by Windows.
This registration process collects information, such as a key permissionς χρήσης, address IP and email address, which it then uploads to a server.
All this information, until recently, was publicly exposed and one user pointed out that the user information database was available to anyone. The database lists about 20.000 entries for users.
“The fxkeys array contains the metadata for all registered Pro licenses for Linuxfx, consisting of license key, email address and some other information (expiration, quantity of machines with license etc.).”
The table contains the metadata for all the installations that Linuxfx sends the first time.
Contains its IP address machinedata, some other metadata from an IP geolocation service (defined by the customer) and the license key (if enabled).
There are just over 20.000 entries in this file, which is far from the number of 1 million listed by the company.
With this information, anyone can associate an activated installation with its IP address with the email address of its owner, which of course is not good.
