Tinder security flaw granted account access with just a phone number

22 February, 2018, 10:27 | Author: Darnell Taylor
  • Anand Prakash has made a career out of exposing security bugs
Credit
Supplied

Using this vulnerability, attacker would get complete control of the target account. Thus it was possible to create an authorization token belonging to a stranger from Account Kit, and then send it to Tinder's app to log in as that person.

App developers should take a long, hard look at how they use Facebook's Account Kit for identifying users - after a flaw in the system, and Tinder's use of the toolkit, left shag-seekers open to account hijacking. First is the API of Tinder and the other is through Facebook's Account Kit system which safeguards user's logins.

Anand Prakash from Appsecure explained how the attack works on Tinder, "The user clicks on Login with Phone Number on tinder.com and then they are redirected to Accountkit.com for login".

Tinder accounts could be vulnerable to risks from hackers thanks to just one mobile number, according to revelations made by cyber security company AppSecure. But there is no need to worry because the good news is that after being alerted by Appsecure, Tinder has fixed the issue.

Instagram Explains Why They Deleted Florida School Shooter's Account
Ms Thorne said she shook Mr Ryan's hand and introduced herself but added: "You're here celebrating the death of 17 children". Trump said earlier on Friday that he is traveling to Florida to meet with people impacted by the shooting.


Santa Barbara Asset Management LLC Acquires Shares of 2322032 Comcast Co. (CMCSA)
If we look at the Volatility of Comcast Corporation (CMCSA ), Week Volatility is 3.45%, whereas Month Volatility is at 2.96%. Comcast Corporation (CMCSA ) indicated a yearly performance of 4.65% while year-to-date (YTD) performance stood at 0.07%.


Parkland students turned away from meeting Florida lawmakers
The 71-36 vote in the Republican-controlled body shocked students who were sitting in the gallery of the Capitol building. Students across Central Texas staged walkouts on Wednesday afternoon to bring awareness to gun violence in schools.


According to AppSecure, the account takeover vulnerability in Tinder ensures that an attacker can gain access to the dating app account with any phone number, which is used to login. Conveniently enough, Account Kit also had a bug in which an attacker could have gained access to any user's Account Kit simply by using their phone number. Supplying a phone number as a "new_phone_number" parameter in an API call over HTTP skipped the verification code check, and the kit returned a valid "aks" authorization token.

Have you fallen victim to a social media hack?

Appsecure said the vulnerabilities were quickly resolved with Facebook paying a $5,000 bounty and Tinder paying a $1,250 reward.

Recommended:

  • Trump Announces He'll Ban Rifle 'Bump Stocks' After Florida Shooting

    Trump Announces He'll Ban Rifle 'Bump Stocks' After Florida Shooting

    Andrew Pollack's daughter Meadow was killed in last week's mass shooting . 9/11 happened once - and they fixed everything. The fifth point on the note was "I hear you". "King David Cemetery, that is where I go to see my kid now".
    Irrfan Khan out of action due to jaundice

    Irrfan Khan out of action due to jaundice

    Apart from Irrfan, the film also stars Kirti Kulhari, Arunoday Singh , Divya Dutta and "3 Idiots" fame Omi Vaidya. Produced by T-Series' Bhushan Kumar and RDP Motion Pictures, Blackmail is slated to release on April 6, 2018.
    Duke drops Louisville to continue hot streak

    Duke drops Louisville to continue hot streak

    The Blue Devils blew out Louisville at Cameron Indoor Stadium, 82-56 to continue a remarkable turnaround. After the game, Duke coach Mike Krzyzewski offered little insight into when Bagley would play next.
  • President Trump seeks ban on bump stock gun modifications

    President Trump seeks ban on bump stock gun modifications

    It was criticized by attendee Mark Barden, whose son, Daniel, was killed in the Sandy Hook elementary school shooting in 2012. He asked, "How many schools, how many children have to get shot?" 9/11 happened once and they fixed everything.
    Finnish skater comes from a family of Winter Olympians

    Finnish skater comes from a family of Winter Olympians

    She displaced Vonn in silver medal position, but Goggia held on to become the first Italian victor of the event. She earned a lot of attention for tweeting during the event while earning her place among Olympic athletes.
    Isner hits 30 aces but loses to Gojowczyk at Delray Beach

    Isner hits 30 aces but loses to Gojowczyk at Delray Beach

    Sock made it a first-day sweep for Americans. "He had three match points, but I played well". The American will next face Peter Gojowczyk, who won in three sets against Lukas Lacko.
  • Sushma Swaraj to meet Canadian counterpart ahead of PM Modi-Trudeau talks

    Sushma Swaraj to meet Canadian counterpart ahead of PM Modi-Trudeau talks

    It was later reported that Justin Trudeau had cancelled a dinner invite Jaspal Atwal, who is a convicted Khalistani terrorist. At the time of the 1986 shooting, he was a Sikh separatist active in the pro-Khalistan International Sikh Youth Federation.
    Harvey Weinstein slams Gwyneth Paltrow's allegations

    Harvey Weinstein slams Gwyneth Paltrow's allegations

    Human garbage dump Harvey Weinstein is trying to get one of the class action lawsuits filed against him tossed, according to TMZ . They say Gwyneth Paltrow worked with Weinstein and won an Oscar after he was accused of harassing her in an earlier project.
    Women's big air medals awarded in PyeongChang

    Women's big air medals awarded in PyeongChang

    In the final, the riders each had to land two different tricks, spinning different ways, and the total score decided the victor . Gasser was one of the few who didn't hold back in this year's slopestyle event , which was plagued by awful weather conditions.
  • New Android enterprise program recommends best phones for businesses and professionals

    New Android enterprise program recommends best phones for businesses and professionals

    Even more odd is that Samsung's flagship devices are not listed, but that could change with the release of the Galaxy S9 and S9+. In addition, OEMs in the program receive an enhanced level of technical support and training from Google.

    Knuckling Down on Shares of American Tower Corporation (REIT) (NYSE:AMT)

    A month ago, they told us to expect earnings of US$0.83 per share while three months ago their EPS consensus estimate was US$0.85. Cambridge Financial Group Inc increased Walgreens Boots Alliance Inc stake by 2,113 shares to 67,108 valued at $5.18B in 2017Q3.

    ValuEngine Downgrades Huntington Bancshares (NASDAQ:HBAN) to Hold

    New York State Teachers Retirement Sys has 0.07% invested in Huntington Bancshares Incorporated (NASDAQ:HBAN) for 2.01M shares. The Delaware-based Riverhead Cap Ltd Liability Com has invested 0.02% in Huntington Bancshares Incorporated (NASDAQ: HBAN ).


Popular

BC wine industry launches lawsuit against Alberta ban
The B.C. government is seeking feedback on five points. "It seems unfair on both sides", Ocenas said. The AGLC had 160,000 cases, or about a 30-to 35-day stock of B.C. wine, on February 6.

Kyle Busch, Jimmie Johnson, others crash early in 2018 Daytona 500
He had started the race in the rear after the team had to pull out the backup vehicle from a qualifying race crash. Most veteran drivers - and even fans - are quick to blame young drivers for causing big wrecks.

Andrew Luck not yet throwing footballs, but he is throwing
In an interview with Peter King on Tuesday, Luck said the " ship has sailed " on him needing a second surgery. As King notes, House said he expects Luck to be able to throw without restriction at some point this spring.

Michigan roads flood as rivers rise to record levels
Wednesday's high temperatures could approach 90° across the lower Southwest. "Ice that is not moving needs to be reported". The city of Stryker will likely see flowing water well above the bounds of the river, into surrounding low-lying fields.

Justin And Selena Spotted Doing LipLock
It wasn't long after Selena's health crisis surfaced that reports stated her relationship with The Weeknd was coming to an end. Justin has been to the Montage several times before and always loves going there for a quick getaway.

'Challenge accepted' | Snack smugglers react to Cinemark's new bag rule
A manager of the Wichita Falls Cinemark confirmed this new bag policy will be implemented at their location in Parker Square. As for Cinemark, if you bring a bag that's too big, you'll have to turn around and head back to your vehicle to drop it off.

Vodafone Group Plc (VOD) Shares Sold by Catalyst Capital Advisors LLC
BidaskClub cut shares of Vodafone Group from a "buy" rating to a "hold" rating in a research report on Thursday, January 18th. Westpac Bk holds 0.01% or 954 shares. 410.35 million shares or 0.47% more from 408.41 million shares in 2017Q2 were reported.

McDonald's Is Releasing A Podcast About The 'Rick And Morty' Sauce Riots
Let us know in the comment section below! Just hit the buttons on the top of this page. A disappointed " Rick and Morty " fan looking for Szechuan sauce.

Fed officials: Stronger economy boosts chance for rate hikes
Yield on the 10-year note initially fell from session highs after the release , but recovered to reach a fresh four-year high . Officials at the US Federal Reserve have hinted at gradual hikes in interest rates this year.

LG K8, K10 2018 edition budget phones launched ahead of MWC 2018
Unlike the K8 2018, the 3000 mAh battery on the K10 2018 is non-user replaceable with no mention of fast charging support. The K10 and K10 Alpha come with 2GB of RAM and 16GB of storage while the K10 Plus will offer 3GB RAM and 64GB of storage.