Hacking Grindr Accounts with Copy and Paste • Hacker News Board

Re: Hacking Grindr Accounts with Copy and Paste

#51

Post by HenryBemis » Fri, Oct 02, 2020, 11:12 PM UTC

Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

Logging IP address and have some AI/SIEM comparing IPs of regular/past use to IPs on-or-after a password reset can give 'some' level of comfort. E.g. if someone has extensive use from NY-USA IP address and the requests came from a Paris-FR IP address then 99% it is an attack and you block or send out email/SMS (just in case) or 1% that person's company guest WiFi surfaces in another country (e.g. mega-big insurance company in London has corp internet exiting in Chicago and guest network exiting in London).

In any case, it is better/safer to cause some slight inconvenience to prevent data leak.

Re: Hacking Grindr Accounts with Copy and Paste

#52

Post by HenryBemis » Fri, Oct 02, 2020, 11:15 PM UTC

hiharryhere wrote: post #20

That’s appalling Bug bounties are are well and good, but a basic pen test would have picked that up. They aren’t that expensive and for a business trading in data that can get you killed in some parts of the world, should be mandatory.

It's not a bug. It is either a backdoor placed there from the design/implementation or super lazy programming. I don't want to think it's done on purpose (Hanlon's razor).

Re: Hacking Grindr Accounts with Copy and Paste

#53

Post by DevX101 » Fri, Oct 02, 2020, 11:17 PM UTC

If your company is being actively targeted by nation states (and rest assured, Grindr is), you should have a serious security team where this sort of stuff shouldn't have seen the light of day.

I'm not exaggerating when I say this bug may have gotten people locked up, or been the lever for corporate/government espionage.

Re: Hacking Grindr Accounts with Copy and Paste

#54

Post by newswasboring » Fri, Oct 02, 2020, 11:20 PM UTC

perardi wrote: post #11

OK, I know it’s easy to say “well of course it’s not safe, don’t send nudes and don’t go on sketchy hookups”. But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.) So, as a thought exercise, how do you make an app like this more secure? Harm reduction is the name of the game. What are the best practices…

> But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.)

No dude, being gay does not give you the license to be disrespectful towards all men.

Re: Hacking Grindr Accounts with Copy and Paste

#55

Post by [deleted] » Fri, Oct 02, 2020, 11:22 PM UTC

newswasboring wrote: post #54

perardi wrote: post #11

OK, I know it’s easy to say “well of course it’s not safe, don’t send nudes and don’t go on sketchy hookups”. But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.) So, as a thought exercise, how do you make an app like this more secure? Harm reduction is the name of the game. What are the best practices…

> But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.) No dude, being gay does not give you the license to be disrespectful towards all men.

[deleted]

Re: Hacking Grindr Accounts with Copy and Paste

#56

Post by joshuaissac » Fri, Oct 02, 2020, 11:22 PM UTC

Nextgrid wrote: post #28

staplor wrote: post #21

Earlier quoted context omitted.

Yes, but even if the referenced security risk is patched you would still be able to find out if some has an account or not since a password reset page will tell you if it has successfully sent an email to an account.

A good password reset page would not disclose such a fact (it would return a successful response with a message "if this email exists, we'll email you" regardless of whether it actually exists) however attempting to create an account would disclose that fact by rejecting an account creation attempt with an existing email, unless they use emails purely as communication channels and accounts are uniquely identified by…

>however attempting to create an account would disclose that fact by rejecting an account creation attempt with an existing email, unless they use emails purely as communication channels

They can tell the user to await an e-mail from them with the confirmation link. Then if the e-mail address is already in use, send an e-mail saying, "somebody, probably you, tried to register as on but we have you down as already". Otherwise, send a normal confirmation link.

Re: Hacking Grindr Accounts with Copy and Paste

#57

Post by WD-42 » Fri, Oct 02, 2020, 11:23 PM UTC

rickyc091 wrote: post #14

trhway wrote: post #10

Earlier quoted context omitted.

someone designed and implemented it. Would be interesting to know the rationale and their train of thought leading to that.

If I had to guess, the developer used that to debug the reset token to QA if the flow worked; then it was forgotten and skipped past Code Review since the team just left a LGTM without actually looking at the code OR there were to many changes to the PR.

This sounds extremely likely, because it sounds like something I would have done.

Re: Hacking Grindr Accounts with Copy and Paste

#58

Post by jdminhbg » Fri, Oct 02, 2020, 11:23 PM UTC

johnday wrote: post #40

perardi wrote: post #15

Earlier quoted context omitted.

Extremely anecdotally: it’s [person_name]@gmail.com I know of very few friends who go through the process of creating a burner email account to sign up for Grindr. Now, maybe that’s different in other countries, but at least in the States, I would bet good money you can guess their Gmail address.

In the case of gmail accounts you could simply prepend +grindr or any other name to the user part of the email address to get something (relatively) unguessable.

You could do that, but most users don't.

Re: Hacking Grindr Accounts with Copy and Paste

#59

Post by Nextgrid » Fri, Oct 02, 2020, 11:24 PM UTC

DevX101 wrote: post #53

If your company is being actively targeted by nation states (and rest assured, Grindr is), you should have a serious security team where this sort of stuff shouldn't have seen the light of day. I'm not exaggerating when I say this bug may have gotten people locked up, or been the lever for corporate/government espionage.

I don't mean to downplay the issue, but why would LGBT-hostile nation-states target Grindr's infrastructure when it's much easier to detect users at the network level based on TLS SNI (since encrypted SNI is still not a thing thanks to corporate influence)?

Re: Hacking Grindr Accounts with Copy and Paste

#60

Post by Nextgrid » Fri, Oct 02, 2020, 11:26 PM UTC

8bitsrule wrote: post #37

That 'bug' is so stupid and elementary that I'm disinclined to think it's a bug. If they had any security people, it'd never have existed. So ... they just don't give a shit . Surprise?

"Security people" spend most of their time dealing with dubious compliance requirements that rarely improve security (in most cases they annoy users and force them to use even less secure workarounds) than actual security like reviewing code to catch things like this and implement policies to make sure unreviewed code doesn't make it to production.