←back to thread

I hacked a dating app (and how not to treat a security researcher)

(alexschapiro.com)
560 points bearsyankees | 8 comments | 12 May 25 16:39 UTC | HN request time: 1.328s | source | bottom
Show context
shayanbahal ◴[12 May 25 18:59 UTC] No.43966407[source]▶
I had a similar experience with another dating app, although they never got back to me. When I tried to get the founders attention by changing his bio to contact me text, they restored a backup lol

years later I saw their instagram ad and tried to see if the issue still exists, and yes it did. Basically anyone with the knowledge of their API endpoints (which is easy to find using the app-proxy-server) you have full on admin capabilities and access to all messages, matching, etc.

I wonder if I should go back and try again... :-?

replies(1): >>43966635 #
1. cobalt60 ◴[12 May 25 19:23 UTC] No.43966635[source]▶
Why not disclose it as a responsible dev with contacts and move on.
replies(1): >>43966771 #
2. pixl97 ◴[12 May 25 19:41 UTC] No.43966771[source]▶
If a company is not responsible enough to follow up on security reports you should not follow up, but instead disclose it to the world.
replies(3): >>43966951 #>>43966972 #>>43968390 #
3. shayanbahal ◴[12 May 25 20:06 UTC] No.43966951[source]▶
I think it took so long that I moved on, but you are right and I should have done that. Probably I'll take a look again to see if I can do it now :)
replies(1): >>43967205 #
4. flutas ◴[12 May 25 20:08 UTC] No.43966972[source]▶
tbh, I agree.

I've sent 2 big bugs like this, one Funimation and one for a dating app.

Funimation you could access anyones PII and shop orders, they ignored me until I sent a linkedin message to their CTO with his PII (CC number) in it.

The "dating" app well they were literally spewing private data (admin/mod notes, reports, private images, bcrytped password, ASIN, IP, etc) via a websocket on certain actions. I figured out those actions that triggered it, emailed them and within 12 hours they had fixed it and made a bug bounty program to pay me out of as a thank you.

Importantly, I also didn't use anyone else's data/account, I simply made another account that I attacked to prove. Yes it cost me a monthly sub ~$10 to do so. But they also refunded that.

5. evantbyrne ◴[12 May 25 20:37 UTC] No.43967205{3}[source]▶
Been there. Nagged the city of Seattle for nearly two years about fixing their insecure digital wallets, and in return they just acted weird to me and never really fixed the problem. Wouldn't tell me anything not even the vendor so I could communicate to them that this issue could exist elsewhere. The goal of these tactics is to delay long enough that you give up on publishing. So publish. Just be ethical and stay within the bounds of the law on what you access and release.
replies(1): >>43967306 #
6. shayanbahal ◴[12 May 25 20:47 UTC] No.43967306{4}[source]▶
I did a quick test and seems like the full admin access that I used to get is slightly fixed/changed. I'm wondering if there was an issue and I have enough data to show there were full compromised of all users data, but it is changed now (might still be vulnerable but let's say it's not). should I still release something? they should have notified their users of such an issue right?
replies(1): >>43967483 #
7. evantbyrne ◴[12 May 25 21:09 UTC] No.43967483{5}[source]▶
Sounds worthy of a blog post to me
8. ◴[12 May 25 23:25 UTC] No.43968390[source]▶