Tinder security flaw granted account access with just a phone number
http://ift.tt/2sHNnRZ
Security researchers at Appsecure found a way to access anyone’s Tinder account via their phone number. The exploit took advantage of a software flaw in both the dating app’s login process as well as the Facebook API that it’s based on. The issues have been fixed since, but represent a pretty big security lapse.
"Both the vulnerabilities were fixed by Tinder and Facebook quickly," wrote Appsecure’s Anand Prakash on Medium. Facebook and Tinder rewarded the company $5000 and $1250, respectively, for its report. This isn’t the first report of Tinder security flaws, either, like when the company failed to encrypt user photos and (back in 2014) exposed users’ exact locations for months.
When you login to Tinder, you have the option of using your phone number, which is then passed along to Facebook’s Account Kit for authentication to Tinder. The Appsecure folks found that they could get a valid access token with an API request to Facebook’s Account Kit using a phone number. In addition, Tinder’s login system wasn’t checking these access tokens to make sure they matched the associated user’s client ID, which means that any valid access token could let someone log in to your Tinder account.
<iframe width="560" height="315" src="https://www.youtube.com/embed/tIAxmZt1joY" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe>
Via: The Verge
Source: Appsecure
Tech
via Engadget http://www.engadget.com
February 21, 2018 at 02:24PM