Four major dating apps expose precise locations of 10 million users

Four major dating apps expose precise locations of 10 million users

Updated: In some countries, such lax security can be of real risk to a user’s personal safety.

By Charlie Osborne for Zero Day | August 13, 2019 -- 10:04 GMT (03:04 PDT) 

Application security is in the midst of a transformation. Virtually all enterprise applications and assets have become web-facing whether in the form of a traditional web-application, cloud applications, APIs, microservices, or legacy apps...

Four popular mobile applications offering dating and meetup services have security flaws which allow for the precise tracking of users, researchers claim.

This week, Pen Test Partners said that Grindr, Romeo, and Recon have all been leaking the precise location of users and it has been possible to develop a tool able to collate the exposed GPS coordinates.

The research builds upon a report released last week by Pen Test Partners that related to the safety of relationship application 3Fun.
3Fun, a mobile application for arranging threesomes and dates, had some of the "worst security for any dating app we've ever seen," according to the team.

It was found that 3Fun was not only leaking the locations of users but also information including their dates of birth, sexual preferences, pictures, and chat data.

Bringing together 3Fun, Grindr, Romeo, and Recon, the team were able to create maps of user locations across the world by using GPS spoofing and trilateration -- the use of algorithms based on longitude, latitude, and altitude to create a three-point map of a user's location.
"By supplying spoofed locations (latitude and longitude) it is possible to retrieve the distances to these profiles from multiple points, and then triangulate or trilaterate the data to return the precise location of that person," the researchers say. Together, the security issues may impact up to 10 million users globally. The image below shows London users of the applications as an example:

Failure to secure and mask the true locations of users is problematic, but in some countries, these leaks could represent a real risk to individual safety.

As shown below in Saudi Arabia, for example, you can see users who may be persecuted for their sexual preferences -- with particular reference to the LGBT+ community -- as well as their overall sexual activities.  

In some cases, the researchers said that locations of eight decimal places in latitude/longitude were reported, which suggests that highly accurate GPS data is being stored on servers.

The app developers were all notified of the researchers' findings on June 1, 2019. Romeo responded within seven days and said there is already a feature enabled which allows users to move themselves to a rough position rather than utilize GPS.

However, this is not a default setting and users must enable it themselves.

Recon said the issue has now been resolved by moving to a "snap to grid" setup.

A "snap to grid" system seems to be one of the most reasonable ways to resolve precise tracking. Rather than pinpointing the exact location of a user, this would "snap" a user to the nearest grid square, which provides a rough area and keeps the exact location of someone hidden from prying eyes.

Grindr did not respond to the disclosure. 3Fun worked with the researchers and requested advice on how to plug its data leak.
Pen Test Partners recommends that users should be given real, transparent options in how their location data is used so risk factors are known and understood.

"It is difficult to for users of these apps to know how their data is being handled and whether they could be outed by using them," the researchers say. "App makers must do more to inform their users and give them the ability to control how their location is stored and viewed."

In related news this week, researcher Darryl Burke reported that the Chinese 'version' of Tinder, called Sweet Chat, has also been leaking chat content and photos via an unsecured server.

Update 15.17 BST: A Grindr spokesperson told ZDNet:

"The safety and security of our users is a core value at Grindr, and we are deeply committed to creating a safe online environment for all of our users. As part of this commitment, we have put in place a number of security measures, and are always looking at ways to enhance these features.
Grindr is designed to connect individuals based on their proximity.  As such, the app allows users to share their location information, as indicated in our privacy policy.  While users have the option to hide their distance information from their profiles, location information is necessary to show users who are nearby. 

In countries where it is dangerous/illegal to be a member of the LGBTQ+ community, Grindr further obfuscates user geolocation information."


Popular posts from this blog

Report: World’s 1st remote brain surgery via 5G network performed in China

Visualizing The Power Of The World's Supercomputers

BMW traps alleged thief by remotely locking him in car