Popular dating app Bumble leaked users’ exact location – Security
A software program engineer at payments processor Stripe located a vulnerability in courting app Bumble that could be utilised to discern the correct site of end users, most likely putting end users at possibility.
By discovering how Bumble’s software programming interface (API) performs, software program engineer Robert Heaton located a way to pinpoint users’ correct site, bypassing the safeguards in the app made to avert this.
Heaton utilised two phony Bumble profiles, a single for the attacker and a single for the victim.
He was in a position to bypass signature checks for API requests which received him all-around Bumble’s paywall.
Currently being in a position to send out arbitrary requests to Bumble’s API permitted Heaton to perform out how the app calculated and offered matching users’ approximate destinations by rounding down the correct length they are from each other.
With that data, Heaton was in a position to devise a trilateration assault, which in a equivalent style to triangulation would reveal the site of the victim Bumble person.
Heaton described the vulnerability to Bumble through bug bounty site HackerOne.
A take care of was deployed in just 72 hours, and Heaton was awarded US$2000, which he donated to charity.
“This is the next severe vulnerability in Bumble in new instances.
In November final year, scientists at Unbiased Security Evaluators discovered that it was not only feasible to bypass spending for the Bumble Increase premium functions, but also to dump all the courting app’s person data which includes images.”
Bumble has all-around 100 million end users throughout the world, and was developed by Tinder co-founder Whitney Wolfe Herd and the founder of social network Badoo, Andrey Andreev.
