30. Oktober 2020

Therefore I reverse engineered two apps that are dating.

And I also got a zero-click session hijacking as well as other enjoyable weaknesses

On this page I reveal a few of my findings throughout the engineering that is reverse of apps Coffee Meets Bagel and also the League. We have identified a few critical weaknesses throughout the research, every one of which have already been reported into the vendors that are affected.


In these unprecedented times, greater numbers of individuals are escaping to the world that is digital handle social distancing. Over these times cyber-security is much more essential than ever before. From my restricted experience, really few startups are mindful of security recommendations. The businesses accountable for a big array of dating apps are no exclusion. We began this small research study to see exactly just exactly how secure the latest relationship apps are.

Accountable disclosure

All severity that is high disclosed in this article have already been reported towards the vendors. By the period of publishing, matching patches have already been released, and I also have actually separately confirmed that the repairs come in destination.

I am going to maybe perhaps perhaps not offer details within their proprietary APIs unless appropriate.

The prospect apps

We picked two popular dating apps available on iOS and Android os.

Coffee Suits Bagel

Coffee matches Bagel or CMB for brief, established in 2012, is renowned for showing users a restricted wide range of matches each and every day. asiandate They are hacked when in 2019, with 6 million reports taken. Leaked information included a name, current email address, age, enrollment date, and sex. CMB was popularity that is gaining modern times, and makes an excellent prospect because of this task.

The League

The tagline for The League software is intelligently” that is“date. Launched a while in 2015, it really is an app that is members-only with acceptance and fits according to LinkedIn and Twitter pages. The application is much more costly and selective than its options, it is protection on par aided by the cost?

Testing methodologies

I take advantage of a variety of static analysis and analysis that is dynamic reverse engineering. For fixed analysis we decompile the APK, mostly using apktool and jadx. For powerful analysis an MITM is used by me system proxy with SSL proxy capabilities.

A lot of the evaluating is completed in a very Android that is rooted emulator Android os 8 Oreo. Tests that need more capabilities are done on an actual Android os device lineage that is running 16 (predicated on Android os Pie), rooted with Magisk.

Findings on CMB

Both apps have large amount of trackers and telemetry, but i suppose that is simply their state regarding the industry. CMB has more trackers compared to the League though.

See whom disliked you on CMB with this specific one trick that is simple

The API includes a pair_action industry in almost every bagel item which is an enum utilizing the after values:

There is an API that offered a bagel ID returns the object that is bagel. The bagel ID is shown into the batch of day-to-day bagels. Therefore you, you could try the following if you want to see if someone has rejected:

This really is a vulnerability that is harmless however it is funny that this industry is exposed through the API it is unavailable through the software.

Geolocation information drip, not really

CMB shows other users’ longitude and latitude up to 2 decimal places, that will be around 1 square mile. Happily this info is perhaps maybe perhaps not real-time, which is just updated whenever a person chooses to upgrade their location. (we imagine this is employed because of the software for matchmaking purposes. I’ve maybe perhaps perhaps not confirmed this theory.)

Nevertheless, this field is thought by me might be concealed through the reaction.

Findings on The League

Client-side created verification tokens

The League does something pretty unusual within their login flow:

The UUID that becomes the bearer is completely client-side generated. Even Worse, the host will not validate that the bearer value is a genuine legitimate UUID. It may cause collisions as well as other issues.

I will suggest changing the login model and so the bearer token is created server-side and provided for the client when the host gets the right OTP through the customer.

Telephone number drip with an unauthenticated API

Into the League there is an unauthenticated api that accepts a contact quantity as question parameter. The API leakages information in HTTP reaction code. Once the telephone number is registered, it comes back 200 okay , nevertheless when the true quantity just isn’t registered, it comes back 418 we’m a teapot . It may be mistreated in a couple of methods, e.g. mapping all of the figures under a location code to see that is on The League and that is perhaps not. Or it may result in embarrassment that is potential your coworker realizes you’re on the application.

This has because been fixed once the bug ended up being reported towards the merchant. Now the API simply returns 200 for many demands.

LinkedIn task details

The League integrates with LinkedIn to exhibit a user’s job and employer title on the profile. Often it goes a bit overboard collecting information. The profile API comes back detail by detail work position information scraped from LinkedIn, such as the begin year, end 12 months, etc.

As the application does ask individual authorization to see LinkedIn profile, the consumer most likely will not expect the position that is detailed become a part of their profile for everyone to look at. I really do perhaps perhaps not genuinely believe that sort of info is needed for the application to work, and it will oftimes be excluded from profile information.