A security vulnerability in the fitness app Strava allowed suspicious figures to identify and track security personnel working at secretive bases in Israel, a disinformation watchdog says.
FakeReporter found that by uploading fake running "segments" a user could learn the identities and past routes of others active in the area, even if they had the strongest privacy settings.
Information about 100 individuals who exercised at six bases was viewable.
Strava said it had addressed the issue.
The Israeli military said it was "aware of the evolving threats in cyberspace".
"In order to handle these threats, and in light of previous events such as the one mentioned, the rules and regulations are regularly reiterated and reinforced among those serving in sensitive positions," it added.
This is not the first time that Strava's tracking features have sparked such security concerns.
In 2018, the company published a global "heatmap" that revealed the exercise routes of people at military bases around the world, including US facilities in Syria and Afghanistan.
San Francisco-based Strava is used by more than 95 million people in 195 countries.
Its app takes data, including GPS co-ordinates, from a person's mobile phone or wearable fitness device to track their exercise activity.
People are able to upload their running and cycling times and compare their performances with others who followed the same routes.
FakeReporter, an Israeli group that combats malicious online activity, reported that a suspicious user named "Ez Shehl" had exploited these functions to upload fake GPS data to create route segments inside secret facilities associated with Israel's military, the Mossad intelligence agency and the Shin Bet internal security service.
The segments featured straight GPS lines, no times, and unrealistic pacing, such as covering 500m in 0 seconds.
The timings and personal details – including photos, home addresses and the identities of family members – of other users who ran the same segments were subsequently revealed on the Strava scoreboard, even if they had their accounts set to "private".
A senior defence official identified as "N" was one of at least 100 Israeli individuals affected by the vulnerability, according to FakeReporter. It posted screenshots showing runs from their home and inside various air force bases in Israel, as well as runs in Ukraine.
FakeReporter said it had told Israeli authorities about the security breach as soon as it became aware and that it had contacted Strava after receiving their approval.
"Despite past revelations, it does not appear that Israeli security agencies have caught up," Achiya Schatz, the watchdog's director, said in a statement. "Although Strava made significant updates to its privacy settings, confused users might still be exposed publicly, even if their profiles were set to 'private'."
"By exploiting the capability to upload engineered files, revealing the details of users anywhere in the world, hostile elements have taken one alarming step closer to exploiting a popular app in order to harm the security of citizens and countries alike."
Strava told Israel's Haaretz newspaper: "We take matters of privacy very seriously and have addressed the reported issues."
Coronavirus creates boom in digital fitness
The app that inspires tens of millions to go cycling
Truss under pressure, as new UK chancellor gets to work
Mine blast in northern Turkey kills 40
Musk: SpaceX cannot keep funding Ukraine Starlink
How we are uncovering Iran's protests and crackdowns
Women, men, children – faces of those who have died in Iran
The Ukrainian city where Russia is still advancing
Will the UK financial chaos spark a wider meltdown?
The Ikea-style flat-pack home for refugees. Video
'I saved for 30 years to see the Titanic' Video
The man who made burgers and pizzas popular in India
Canoes and caring neighbours brave Nigeria floods
The theory that could solve evolution's biggest mystery. Video
How emotional cheating destroys couples
A controversial archaeological find
The US' puzzling, paranormal mystery
© 2022 BBC. The BBC is not responsible for the content of external sites. Read about our approach to external linking.
