Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Grindr Accounts with Copy and Paste

troyhunt.com

Post reply on HN
Print view View original

11–20 of 202 posts

Re: Hacking Grindr Accounts with Copy and Paste

#11

Post by perardi »

OK, I know it’s easy to say “well of course it’s not safe, don’t send nudes and don’t go on sketchy hookups”. But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.)

So, as a thought exercise, how do you make an app like this more secure? Harm reduction is the name of the game. What are the best practices for this? Is it 2FA? Is it encryption keys linked to one device? Is it copying principles from Signal? Is it just having competent developers?

Re: Hacking Grindr Accounts with Copy and Paste

#12

Post by djaque »

trhway wrote: post #10
sebmellen wrote: post #4

Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?

someone designed and implemented it. Would be interesting to know the rationale and their train of thought leading to that.

"It's friday and I want to go home" :)

But seriously, I'm sure it was made by people that just didn't stop to think about security and "it works, so we're done here" Then, as a business you're not going to try and fix it if the software already works. That would be pure cost.

Re: Hacking Grindr Accounts with Copy and Paste

#13

Post by sebmellen »

perardi wrote: post #11

OK, I know it’s easy to say “well of course it’s not safe, don’t send nudes and don’t go on sketchy hookups”. But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.) So, as a thought exercise, how do you make an app like this more secure? Harm reduction is the name of the game. What are the best practices…

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security flaw you could ever encounter.

Other steps are nice to think about, but ensuring basic security measures would preempt 99% of data breaches and "hacks".

Re: Hacking Grindr Accounts with Copy and Paste

#14

Post by rickyc091 »

trhway wrote: post #10
sebmellen wrote: post #4

Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?

someone designed and implemented it. Would be interesting to know the rationale and their train of thought leading to that.

If I had to guess, the developer used that to debug the reset token to QA if the flow worked; then it was forgotten and skipped past Code Review since the team just left a LGTM without actually looking at the code OR there were to many changes to the PR.

Re: Hacking Grindr Accounts with Copy and Paste

#15

Post by perardi »

jdminhbg wrote: post #6
djaque wrote: post #5

I guess the good news is that it requires knowledge of the user's email address to execute. You can't just run it on random people (emails aren't disclosed) and even if you know someone on the app in real life, chances are good that they use a personal address that you won't have. Still a pretty bad vulnerability and pretty awful that grindr was ignoring it.

> even if you knkw someone on the app, chances are good that they use a personal address that you won't have I doubt that; I bet most users use whatever Gmail/etc personal address they use for other non-work accounts.

Extremely anecdotally: it’s [person_name]@gmail.com

I know of very few friends who go through the process of creating a burner email account to sign up for Grindr. Now, maybe that’s different in other countries, but at least in the States, I would bet good money you can guess their Gmail address.

Re: Hacking Grindr Accounts with Copy and Paste

#16

Post by hn_throwaway_99 »

trhway wrote: post #10
sebmellen wrote: post #4

Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?

someone designed and implemented it. Would be interesting to know the rationale and their train of thought leading to that.

I mean, I don't think it's that hard to surmise how something like this could have happened. Yes, the bug is egregiously bad, but I don't think it's likely the developer purposely designed it to work like that. Some simple possibilities: (a) perhaps the page was originally intended only to be accessible from a user hitting from a private link sent to their email address (i.e. how normal password resets work, or (b) The API in use was designed to only be accessed server-side, but it was inadvertently proxied through to a client-side call.

Again, yes, the bug is very bad. Software is complex, and humans are humans, and it's not difficult to imagine how these bugs occur.

Re: Hacking Grindr Accounts with Copy and Paste

#18

Post by Nextgrid »

> we believe we addressed the issue before it was exploited by any malicious parties

I wonder how they are sure of this.

In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same computer, thus the same IP address showing up on the logs. In case of a malicious attempt the same pattern would be seen - there is no way for them to know whether the user obtained the reset token from the e-mail (as they should) or directly from the password reset endpoint itself.

Re: Hacking Grindr Accounts with Copy and Paste

#19

Post by perardi »

sebmellen wrote: post #13
perardi wrote: post #11

OK, I know it’s easy to say “well of course it’s not safe, don’t send nudes and don’t go on sketchy hookups”. But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.) So, as a thought exercise, how do you make an app like this more secure? Harm reduction is the name of the game. What are the best practices…

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security flaw you could ever encounter. Other steps are nice to think about, but ensuring basic security measures would preempt 99% of data breaches and "hacks".

Yeah, in this particular case, they were just glaringly stupid.

Just gaming out ideas in my head. I have friends from rather more repressive countries, namely China, where being gay is still a grey area in terms of legality and acceptance, and I’m just thinking of better ways to structure a system.

Post reply on HN