Therefore I reverse engineered two apps that are dating.

And I also got a zero-click session hijacking along with other enjoyable weaknesses

In this post I reveal a few of my findings throughout the reverse engineering for the apps Coffee Meets Bagel together with League. We have identified a few critical weaknesses throughout the research, all of these have already been reported into the vendors that are affected.

Introduction

In these unprecedented times, greater numbers of individuals are escaping in to the electronic globe to handle social distancing. Of these right times cyber-security is more essential than in the past. From my experience that is limited few startups are mindful of security recommendations. The firms accountable for a range that is large of apps are no exclusion. We began this little scientific study to see exactly exactly how secure the dating apps that are latest are.

Accountable disclosure

All severity that is high disclosed in this article have already been reported into the vendors. Because of the period of publishing, matching patches have already been released, and I also have actually separately confirmed that the repairs have been in spot.

I’ll perhaps perhaps perhaps not offer details to their APIs that is proprietary unless.

The prospect apps

We picked two popular apps that are dating on iOS and Android os.

Coffee Suits Bagel

Coffee satisfies Bagel or CMB for brief, established in 2012, is well known for showing users a restricted amount of matches each day. They’ve been hacked as soon as in 2019, with 6 million records taken. Leaked information included a name that is full current email address, age, enrollment date, and sex. CMB happens to be gathering popularity in the last few years, and makes a great candidate because of this task.

The League

The tagline for The League application is “date intelligently”. Launched time in 2015, it really is a members-only app, with acceptance and fits according to LinkedIn and Twitter profiles. The application is more selective and expensive than its options, it is protection on par aided by the cost?

Testing methodologies

I personally use a mix of fixed analysis and powerful analysis for reverse engineering. For fixed analysis we decompile the APK, mostly making use of apktool and jadx. For powerful analysis i personally use an MITM system proxy with SSL proxy capabilities.

A lot of the evaluating is completed in the rooted Android emulator running Android 8 Oreo. Tests that need more capabilities are done on a genuine Android unit lineage that is running 16 (predicated on Android os Pie), rooted with Magisk.

Findings on CMB

Both apps have complete great deal of trackers and telemetry, but i suppose that is simply hawaii of this industry. CMB has more trackers compared to the League though.

See whom disliked you on CMB with this specific one trick that is simple

The API includes a pair_action industry in just about every bagel item and it’s also an enum utilizing the values that are following

There is an API that offered a bagel ID returns the object that is bagel. The bagel ID is shown when you look at the batch of day-to-day bagels. Therefore you, you could try the following if you want to see if someone has rejected:

This can be a benign vulnerability, however it is funny that this industry is exposed through the API it is not available through the application.

Geolocation information drip, yet not actually

CMB shows other users’ longitude and latitude up to 2 decimal places, that will be around 1 mile that is square. Luckily this info is perhaps maybe not real-time, and it’s also just updated whenever a user chooses to upgrade their location. (we imagine this can be used because of the software for matchmaking purposes. We have perhaps perhaps perhaps not confirmed this theory.)

Nonetheless, i really do think this industry might be concealed through the reaction.

Findings on The League

Client-side created verification tokens

The League does one thing pretty unusual inside their login flow:

The UUID that becomes the bearer is totally client-side generated. Even even even Worse, the host will not verify that the bearer value is a genuine UUID that is valid. It might cause collisions along with other dilemmas.

I would suggest changing the login model therefore the bearer token is created server-side and delivered to the client after the host gets the proper OTP through the customer.

Contact number drip through an unauthenticated API

Into the League there is an unauthenticated api that accepts a contact quantity as question parameter. The API leakages information in HTTP response code. Whenever contact number is registered, it comes back 200 okay , nevertheless when the quantity is certainly not registered, it comes back 418 I’m a teapot . Maybe it’s abused in several means, e.g. mapping all of the figures under a place rule to see that is in the League and that is maybe maybe perhaps not. Or it may result in possible embarrassment whenever your coworker realizes you might be on the app.

It has since been fixed if the bug had been reported towards the merchant. Now the API merely returns 200 for many requests.

LinkedIn task details

The League integrates with LinkedIn to exhibit a user’s boss and task title on the profile. Often it goes a bit overboard collecting information. The profile API comes back step-by-step work position information scraped from LinkedIn, such as the begin 12 months, end 12 months, etc.

Although the software does ask individual permission to see LinkedIn profile, an individual most likely doesn’t expect the detail by detail place information to be a part of their profile for everybody else to see. I actually do maybe perhaps not genuinely believe that type or types of info is needed for the application to work, and it will oftimes be excluded from profile information.