Therefore I reverse engineered two dating apps

Video and picture drip through misconfigured S3 buckets

Typically for photos or any other asserts, some form of Access Control List (ACL) is set up. A common way of implementing ACL would be for assets such as profile pictures

The main element would act as a “password” to gain access to the file, additionally the password would simply be provided users who require use of the image. When it comes to an app that is dating it’s going to be whoever the profile is presented to.

I’ve identified several misconfigured S3 buckets on The League through the research. All photos and videos are inadvertently made general general public, with metadata such as which user uploaded them so when. Typically the software would have the pictures through Cloudfront, a CDN on top for the buckets that are s3. Unfortunately the s3 that is underlying are severely misconfigured.

Side note: as much as i can inform, the profile UUID is arbitrarily produced server-side if the profile is done. To make certain that part is not likely to be very easy to guess. The filename is managed because of the customer; any filename is accepted by the server. In your client app it’s hardcoded to upload.jpg .

The seller has since disabled listObjects that are public. But, we nevertheless think there must be some randomness within the key. A timestamp cannot act as key.

internet protocol address doxing through website link previews

Link preview is something this is certainly difficult to get appropriate in a complete large amount of messaging apps. You will find typically three techniques for website website website link previews:

The League makes use of link that is recipient-side. Whenever an email includes a hyperlink to an image that is external the web link is fetched on user’s unit as soon as the message is seen. This might efficiently enable a malicious transmitter to submit an external image URL pointing to an attacker managed host, obtaining recipient’s internet protocol address as soon as the message is exposed.

A significantly better solution could be merely to connect the image into the message when it’s sent (sender-side preview), or have actually the server fetch the image and place it when you look at the message (server-side preview). Server-side previews allows anti-abuse scanning that is additional. It might be a significantly better choice, but nevertheless maybe maybe perhaps perhaps not bulletproof.

Zero-click session hijacking through talk

The application will attach the authorization sometimes header to demands which do not need verification, such as for example Cloudfront GET needs. It will likewise happily hand out the bearer token in requests to domains that are external some situations.

Those types of instances could be the image that is external in chat messages. We already fully know the application utilizes recipient-side link previews, in addition to demand to your outside resource is performed in recipient’s context. The authorization header is roofed when you look at the GET demand towards the outside image Address. And so the bearer token gets leaked to your outside domain. Whenever a sender that is malicious a graphic website link pointing to an attacker controlled server, not merely do they get recipient’s internet protocol address, nonetheless they additionally obtain victim’s session token. This can be a vulnerability that is critical it enables session hijacking.

Observe that unlike phishing, this assault doesn’t need the target to go through the website link. Once the message containing the image website website website website link is seen, the software immediately leaks the session token into the attacker.

This indicates to be a bug linked to the reuse of a okHttp client object that is global. It might be most readily useful if the designers ensure that the application just attaches authorization bearer header in demands to your League API.

Conclusions

I didn’t find any vulnerabilities that are particularly interesting CMB, but that will not mean CMB is much more safe compared to the League. (See Limitations and future research). Used to do look for a few protection dilemmas into the League, none of that have been especially hard to find out or exploit. I assume it truly is the typical errors individuals make over and over repeatedly. OWASP top anybody?

As customers we have to be mindful with which companies we trust with your information.

Vendor’s reaction

Used to do get a prompt reaction from The League after giving them a message you could try here alerting them for the findings. The S3 bucket setup had been swiftly fixed. One other weaknesses had been patched or at the least mitigated within a couple weeks.

I believe startups could offer bug bounties certainly. It is a gesture that is nice and even more importantly, platforms like HackerOne offer scientists an appropriate way to the disclosure of weaknesses. Unfortuitously neither regarding the two apps when you look at the post has program that is such.

Limits and research that is future

This scientific studies are maybe maybe not comprehensive, and may never be regarded as a safety review. All the tests on this page had been done regarding the community IO degree, and hardly any on the customer it self. Particularly, we did not test for remote rule execution or buffer overflow kind weaknesses. In future research, we’re able to look more in to the safety regarding the customer applications.

This might be finished with powerful analysis, utilizing techniques such as for example: