Hacking Grindr Accounts with Copy and Paste • Hacker News Board

Re: Hacking Grindr Accounts with Copy and Paste

#21

Post by staplor » Fri, Oct 02, 2020, 10:17 PM UTC

djaque wrote: post #9

sebmellen wrote: post #7

Earlier quoted context omitted.

Imagine someone running their contact list through this. You could find everyone you know on Grindr right away, and snoop on their conversations and read their personal info... Not only that, but emails are very easy to find these days with tools like apollo.io.

Good point, even just being able to use it as a tool to play "gay or not" has some pretty aweful implications for people who aren't openly gay.

Yes, but even if the referenced security risk is patched you would still be able to find out if some has an account or not since a password reset page will tell you if it has successfully sent an email to an account.

Re: Hacking Grindr Accounts with Copy and Paste

#22

Post by sebmellen » Fri, Oct 02, 2020, 10:20 PM UTC

Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

$50 says they're not. This is something every organization has to say for PR reasons, but saying "we believe" is very fishy wording. It could well be this bug has been around for months before it was discovered, and used by many black/grey-hat hackers.

Re: Hacking Grindr Accounts with Copy and Paste

#23

Post by hiharryhere » Fri, Oct 02, 2020, 10:21 PM UTC

hn_throwaway_99 wrote: post #16

trhway wrote: post #10

Earlier quoted context omitted.

someone designed and implemented it. Would be interesting to know the rationale and their train of thought leading to that.

I mean, I don't think it's that hard to surmise how something like this could have happened. Yes, the bug is egregiously bad, but I don't think it's likely the developer purposely designed it to work like that. Some simple possibilities: (a) perhaps the page was originally intended only to be accessible from a user hitting from a private link sent to their email address (i.e. how normal password resets work, or (b) T…

That’s why doing pen tests on the regular is necessary. We shouldn’t rely on humans getting it right every time, or strangers on the internet reporting it.

Re: Hacking Grindr Accounts with Copy and Paste

#24

Post by Nextgrid » Fri, Oct 02, 2020, 10:22 PM UTC

trhway wrote: post #10

sebmellen wrote: post #4

Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?

someone designed and implemented it. Would be interesting to know the rationale and their train of thought leading to that.

From experience I noticed that a lot of developers don't look at the big picture and don't have a full understanding of how the system works, what's the rationale behind how the feature achieved its objective and how it might be abused by a malicious user. The #1 thing that I think about when I'm looking at some code or feature (and recommend others do the same) is how malformed or intentionally malicious input would break it, but it seems like their developers clearly didn't do so.

This is also compounded by the drive to artificially complicate software stacks (microservices, etc) and "silo" developers into their own little bubble where they only work on a small aspect of the system and never have a need (nor the mental capacity - due to intentionally complicated stacks with dozens of microservices in various languages) to look at the big picture.

Re: Hacking Grindr Accounts with Copy and Paste

#25

Post by grayfaced » Fri, Oct 02, 2020, 10:22 PM UTC

Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

I was disturbed by that statement as well. It's pure PR spin based on turning a blind eye.

They could detect mass malicious activity if a single IP was resetting thousands of accounts. But I'm skeptical they even checked based on the horrible initial flaw and specious response.

Re: Hacking Grindr Accounts with Copy and Paste

#26

Post by ghostbrainalpha » Fri, Oct 02, 2020, 10:23 PM UTC

sebmellen wrote: post #13

perardi wrote: post #11

OK, I know it’s easy to say “well of course it’s not safe, don’t send nudes and don’t go on sketchy hookups”. But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.) So, as a thought exercise, how do you make an app like this more secure? Harm reduction is the name of the game. What are the best practices…

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security flaw you could ever encounter. Other steps are nice to think about, but ensuring basic security measures would preempt 99% of data breaches and "hacks".

Could you explain why that's bad for someone who knows nothing about security?

Where should the password reset token be?

Re: Hacking Grindr Accounts with Copy and Paste

#27

Post by dewey » Fri, Oct 02, 2020, 10:24 PM UTC

ghostbrainalpha wrote: post #26

sebmellen wrote: post #13

Earlier quoted context omitted.

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security flaw you could ever encounter. Other steps are nice to think about, but ensuring basic security measures would preempt 99% of data breaches and "hacks".

Could you explain why that's bad for someone who knows nothing about security? Where should the password reset token be?

In an email sent to the address linked to the account.

Re: Hacking Grindr Accounts with Copy and Paste

#28

Post by Nextgrid » Fri, Oct 02, 2020, 10:24 PM UTC

staplor wrote: post #21

djaque wrote: post #9

Earlier quoted context omitted.

Good point, even just being able to use it as a tool to play "gay or not" has some pretty aweful implications for people who aren't openly gay.

Yes, but even if the referenced security risk is patched you would still be able to find out if some has an account or not since a password reset page will tell you if it has successfully sent an email to an account.

A good password reset page would not disclose such a fact (it would return a successful response with a message "if this email exists, we'll email you" regardless of whether it actually exists) however attempting to create an account would disclose that fact by rejecting an account creation attempt with an existing email, unless they use emails purely as communication channels and accounts are uniquely identified by username/account number instead.

Re: Hacking Grindr Accounts with Copy and Paste

#29

Post by Jtsummers » Fri, Oct 02, 2020, 10:24 PM UTC

ghostbrainalpha wrote: post #26

sebmellen wrote: post #13

Earlier quoted context omitted.

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security flaw you could ever encounter. Other steps are nice to think about, but ensuring basic security measures would preempt 99% of data breaches and "hacks".

Could you explain why that's bad for someone who knows nothing about security? Where should the password reset token be?

It should’ve been sent via email to the registered email address. That lets the account owner reject it (I didn’t request a password reset!) or use it.

Re: Hacking Grindr Accounts with Copy and Paste

#30

Post by sebmellen » Fri, Oct 02, 2020, 10:24 PM UTC

ghostbrainalpha wrote: post #26

sebmellen wrote: post #13

Earlier quoted context omitted.

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security flaw you could ever encounter. Other steps are nice to think about, but ensuring basic security measures would preempt 99% of data breaches and "hacks".

Could you explain why that's bad for someone who knows nothing about security? Where should the password reset token be?

The token should only be accessible to the user requesting the password reset, meaning that it would be sent via email (this is the standard password reset flow).

The flaw here is that anyone, even if they did not control the email of the user, could reset the password, because the reset token was returned in the browser, where anyone could see it. Essentially, just by knowing someone's email (not having control over it), you could reset their password.