Skip to main content

Tinder security vulnerability allowed hackers to access accounts by entering a user's mobile number

-

entering a user's mobile number




Tinder account can be taken over by just entering a user's phone number. A security firm AppSecure has revealed the flaw also called as 'account takeover vulnerability' in the dating app.
Image credit: Tinder
Image credit: Tinder
According to a report on The Verge, both the companies have fixed the flaw and there is no evidence of any data being leaked because of the security vulnerability. The security flaw allowed access to an account using Facebook AccountKit, a platform which is used to let people quickly register and login to an app using phone number and email address.
According to a blog post by AppSecure a users clicks 'Login with phone Number' on Tinder.com, she/he is then redirected to Accountkit.com for login. "If the authentication is successful then Facebook Account Kit passes the access token to Tinder for login."
The flaw on the dating platform Tinder and Facebook AccountKit was Tinder API not checking the the Client ID on the token provided by Account Kit. This enabled hackers to use any other app's token provided by Account Kit to take over the Tinder accounts.
The blog also mentioned the 'exploit steps' which can be followed to breach into a Tinder account which has now been patched.
The report also mentioned that the flaw was reported to Facebook and Twitter earlier this year and both the companies had awarded the researcher with $5,000 and $1,250 respectively under their respective bug bounty program.
AppSecure is an Indian security firm founded by Anand Prakash, an ex-Flipkart security engineer.

Comments

Post a Comment

Popular posts from this blog

Best April Fools' Day 2017 Pranks in the Tech World

-
Image
It's April 1, and everyone knows it's April Fools' Day when no one's going to believe in whatsoever you may scream. But when it comes to some reputed and trusted tech companies, they easily get into people's minds with their 'new and latest offerings'. These, in most cases, would be hoax or joke offerings - those that will never exist, or those that will be available for a very short time just for laughs. Even before April 1, these companies start pushing their stories to goof around with you - with little teasers, such as the Dash Charge  announcement  that OnePlus had teased, before making briefly  available  the Dash Energy drink in select outlets Here are 2017's April Fools' tech pranks - the gimmicks, goofs, and pranks that companies decided to plan on us. Some are funny, some inane, and some lame. 1. Google Google  has always been on the frontier of people, with quirky innovations that usually get people believe it. It has some bizarre-
Read more

Artesian Joins Hands with Microsoft and Innervate

-
Image
Artesian Solutions, an artificial intelligence-driven relationship intelligence service, has announced a new strategic channel partnership with Microsoft and Innervate Technology Solutions that will help financial service organizations boost their investment in Microsoft Dynamics 365. The Artesian-Microsoft Dynamics 365 integration allows businesses to boost their CRM investment by enhancing mission-critical data with real-time news, people insights, and social media. The integration provides deep and actionable insights to customer-facing teams, thus allowing them to better understand their customers’ needs. And this, in turn, makes certain that they never miss the chance perhaps to strike a conversation or get a high ground in reference to their most big-ticket patrons. Andrew Yates, CEO, Artesian, said , “This partnership between Artesian, Microsoft and Innervate is a fantastic example of leading vendors in B2B software transformation coming together to bring
Read more
-
Experience the Front Row in In Current VR technology most commonly uses virtual reality headsets or multi-projected environments, sometimes in combination with physical environments or props, to generate realistic images, sounds and other sensations that simulate a user's physical presence in a virtual or imaginary environment. A person using virtual reality equipment is able to "look around" the artificial world, move around in it, and interact with virtual features or items. The effect is commonly created by VR headsets consisting of a head-mounted display with a small screen in front of the eyes, but can also be created through specially designed rooms with multiple large screens. The Virtual Reality Modelling Language (VRML), first introduced in 1994, was intended for the development of "virtual worlds" without dependency on headsets. The Web3D consortium was subsequently founded in 1997 for the development of industry standards for we
Read more