Four major dating apps expose precise locations of 10 million users
Four major dating apps expose precise locations of 10
million users
Updated: In some countries, such lax security can be of
real risk to a user’s personal safety.
By Charlie Osborne for Zero Day | August 13, 2019 --
10:04 GMT (03:04 PDT)
Application security is in the midst of a transformation.
Virtually all enterprise applications and assets have become web-facing whether
in the form of a traditional web-application, cloud applications, APIs,
microservices, or legacy apps...
Four popular mobile applications offering dating and
meetup services have security flaws which allow for the precise tracking of
users, researchers claim.
This week, Pen Test Partners said that Grindr, Romeo, and
Recon have all been leaking the precise location of users and it has been
possible to develop a tool able to collate the exposed GPS coordinates.
The research builds upon a report released last week by
Pen Test Partners that related to the safety of relationship application 3Fun.
3Fun, a mobile application for arranging threesomes and
dates, had some of the "worst security for any dating app we've ever
seen," according to the team.
It was found that 3Fun was not only leaking the locations
of users but also information including their dates of birth, sexual
preferences, pictures, and chat data.
Bringing together 3Fun, Grindr, Romeo, and Recon, the
team were able to create maps of user locations across the world by using GPS
spoofing and trilateration -- the use of algorithms based on longitude,
latitude, and altitude to create a three-point map of a user's location.
"By supplying spoofed locations (latitude and
longitude) it is possible to retrieve the distances to these profiles from
multiple points, and then triangulate or trilaterate the data to return the
precise location of that person," the researchers say. Together, the
security issues may impact up to 10 million users globally. The image below
shows London users of the applications as an example:
Failure to secure and mask the true locations of users is
problematic, but in some countries, these leaks could represent a real risk to
individual safety.
As shown below in Saudi Arabia, for example, you can see
users who may be persecuted for their sexual preferences -- with particular
reference to the LGBT+ community -- as well as their overall sexual activities.
In some cases, the researchers said that locations of
eight decimal places in latitude/longitude were reported, which suggests that
highly accurate GPS data is being stored on servers.
The app developers were all notified of the researchers'
findings on June 1, 2019. Romeo responded within seven days and said there is
already a feature enabled which allows users to move themselves to a rough
position rather than utilize GPS.
However, this is not a default setting and users must
enable it themselves.
Recon said the issue has now been resolved by moving to a
"snap to grid" setup.
A "snap to grid" system seems to be one of the
most reasonable ways to resolve precise tracking. Rather than pinpointing the
exact location of a user, this would "snap" a user to the nearest
grid square, which provides a rough area and keeps the exact location of
someone hidden from prying eyes.
Grindr did not respond to the disclosure. 3Fun worked
with the researchers and requested advice on how to plug its data leak.
Pen Test Partners recommends that users should be given
real, transparent options in how their location data is used so risk factors
are known and understood.
"It is difficult to for users of these apps to know
how their data is being handled and whether they could be outed by using
them," the researchers say. "App makers must do more to inform their
users and give them the ability to control how their location is stored and
viewed."
In related news this week, researcher Darryl Burke
reported that the Chinese 'version' of Tinder, called Sweet Chat, has also been
leaking chat content and photos via an unsecured server.
Update 15.17 BST: A Grindr spokesperson told ZDNet:
"The safety and security of our users is a core
value at Grindr, and we are deeply committed to creating a safe online
environment for all of our users. As part of this commitment, we have put in
place a number of security measures, and are always looking at ways to enhance
these features.
Grindr is designed to connect individuals based on their
proximity. As such, the app allows users
to share their location information, as indicated in our privacy policy. While users have the option to hide their
distance information from their profiles, location information is necessary to
show users who are nearby.
In countries where it is dangerous/illegal to be a member
of the LGBTQ+ community, Grindr further obfuscates user geolocation
information."
Comments
Post a Comment