You are here

Hacker, 22, seeks LTR with your computer data: vulnerabilities available on popular OkCupid relationship app

Hacker, 22, seeks LTR with your computer data: vulnerabilities available on popular OkCupid relationship app

No Real Daters Harmed in This Workout

Analysis by Alon Boxiner, Eran Vaknin

With over 50 million users that are registered its launch, plus the bulk aged between 25 and 34, OkCupid the most popular dating platforms globally. Conceived when four buddies from Harvard developed initial free online dating service, it claims that more than 91 million connections are designed through it annually, 50K times made every week also it became the very first major dating internet site to generate a mobile software.

Dating apps allow a comfy, accessible and connection that is immediate other mylol people utilising the application. By sharing personal choices in virtually any area, and using the app’s algorithm that is sophisticated it gathers users to like-minded those who can instantly begin interacting via instant texting.

To generate every one of these connections, OkCupid develops personal pages for many its users, so that it could make the most readily useful match, or matches, centered on each user’s valuable information that is personal.

Needless to say, these step-by-step individual pages are not merely of great interest to love that is potential. They’re also extremely prized by code hackers, as they’re the ’gold standard’ of data either to be used in targeted assaults, or even for offering on with other hacking groups, while they permit assault tries to be extremely convincing to naive goals.

As our scientists have actually uncovered weaknesses in other popular social media marketing platforms and apps, we made a decision to research the app that is okCupid see when we can find something that matched our interests. And then we discovered unique that led us in to a much much much deeper relationship (solely expert, needless to say). OkCupidThe weaknesses we discovered and have now described in this research may have permitted attackers to:

  • Expose users’ sensitive data saved from the software.
  • Perform actions with respect to the target.
  • Steals users’ profile and personal data, choices and traits.
  • Steals users’ authentication token, users’ IDs, along with other delicate information such as e-mail addresses.
  • Forward the info collected in to the attacker’s host.

Check always Point Research informed OkCupid developers in regards to the weaknesses exposed in this research and an answer had been responsibly implemented to make certain its users can properly carry on utilizing the OkCupid software.

OkCupid added: “Not a solitary individual had been relying on the possibility vulnerability on OkCupid, and now we had the ability to repair it within 48 hours. We’re grateful to lovers like Checkpoint whom with OkCupid, place the privacy and safety of y our users first.”

Mobile Phone Platform

We started our research with some reverse engineering the OkCupid Android os Cellphone application (v40.3.1 on Android os 6.0.1). Through the reversing process, we found that the application form is starting a WebView (and allows JavaScript to perform into the context associated with window that is webView and loads remote URLs such as and much more.

Deep links allow attackers’ intents

While reverse engineering the OkCupid application, we discovered it possible to invoke intents in the app via a browser link that it has “deep links” functionality, making.

The intents that the program listens to would be the schema, customized schema and many more schemas:

A custom can be sent by an attacker website website website link which contains the schemas mentioned above. The mobile application will open a webview (browser) window – OkCupid mobile application since the custom link will contain the“section” parameter. Any demand will be delivered utilizing the users’ snacks.

For demonstration purposes, we utilized the following link:

The mobile application starts a webview ( web web web browser) window with JavaScript enabled.

Reflected Cross-Site Scripting (XSS)

As our research proceeded, we’ve discovered that OkCupid primary domain, is susceptible to an XSS assault.

The injection point for the XSS assault had been based in the individual settings functionality.

Retrieving the consumer profile settings is created utilizing an HTTP GET demand provided for the following path:

The area parameter is injectable and a hacker could use it so that you can inject harmful JavaScript rule.

For the true purpose of demonstration, we now have popped a clear alert screen. Note: even as we noted above, the mobile application is starting a WebView screen therefore the XSS is performed within the context of a authenticated individual utilizing the OkCupid application that is mobile.

Related posts

Leave a Comment