Hacking Tinder for Fun and Profit

#1

Post by ydesouza » Wed, Aug 13, 2014, 3:04 PM UTC

Hacking Tinder for Fun and Profit
ydesouza.com

Re: Hacking Tinder for Fun and Profit

#2

Post by crazypyro » Wed, Aug 13, 2014, 3:42 PM UTC

I've been looking into packet tracing some mobile games that operate entirely online. I'm sure the mobile space is packed to the brim with unrestricted APIs... Thanks for the motivation/tips.

Re: Hacking Tinder for Fun and Profit

#3

Post by timtamboy63 » Wed, Aug 13, 2014, 3:56 PM UTC

crazypyro wrote: post #2

I've been looking into packet tracing some mobile games that operate entirely online. I'm sure the mobile space is packed to the brim with unrestricted APIs... Thanks for the motivation/tips.

Oh they absolutely are. If you want a kick, look at snapchat's headers :)

Re: Hacking Tinder for Fun and Profit

#4

Post by robterrell » Wed, Aug 13, 2014, 4:06 PM UTC

crazypyro wrote: post #2

I've been looking into packet tracing some mobile games that operate entirely online. I'm sure the mobile space is packed to the brim with unrestricted APIs... Thanks for the motivation/tips.

I don't think it's an "unrestricted" API if it uses https and you have to intercept and extract an auth token from a valid session. But I get what you mean -- it is fun to look under the covers and see how the big companies do things.

Re: Hacking Tinder for Fun and Profit

#5

Post by crazypyro » Wed, Aug 13, 2014, 4:17 PM UTC

robterrell wrote: post #4

crazypyro wrote: post #2

I've been looking into packet tracing some mobile games that operate entirely online. I'm sure the mobile space is packed to the brim with unrestricted APIs... Thanks for the motivation/tips.

I don't think it's an "unrestricted" API if it uses https and you have to intercept and extract an auth token from a valid session. But I get what you mean -- it is fun to look under the covers and see how the big companies do things.

Yeah, I agree. MITM attacking your own auth token is not a great example of an "unrestricted" API. I'm thinking more POST requests to games where you can edit resources, change high score, etc. The kind of stuff you used to see all the time on web games, before popularity increased to the point where the developers had to take care of it.

I'd just imagine developers are a lot less wary about security holes because they assume that their client is "just" a smartphone and not a rooted packet sniffer.

Re: Hacking Tinder for Fun and Profit

#6

Post by denwer » Wed, Aug 13, 2014, 4:22 PM UTC

Here is a cached version since the response time seems quite high to me: http://webcache.googleusercontent.com/search?q=cache:EqfLajb...

Re: Hacking Tinder for Fun and Profit

#7

Post by fernandotakai » Wed, Aug 13, 2014, 4:30 PM UTC

Is it possible to mitigate this kind of thing by using certificate pinning?

Re: Hacking Tinder for Fun and Profit

#8

Post by oftheloop » Wed, Aug 13, 2014, 4:32 PM UTC

A buddy of mine did almost exactly the same thing a few months back. Here is a link to that http://blog.venkatesh.ca/automating-tinder/

Re: Hacking Tinder for Fun and Profit

#9

Post by eropple » Wed, Aug 13, 2014, 4:40 PM UTC

fernandotakai wrote: post #7

Is it possible to mitigate this kind of thing by using certificate pinning?

How would that help? The client doesn't need to trust anything from the server, just firehose likes back at it.

Even if you were for some reason using client certificates, you'd just have to rip apart the Tinder APK to get the cert and you're done.

Re: Hacking Tinder for Fun and Profit

#10

Post by cheepin » Wed, Aug 13, 2014, 4:42 PM UTC

You can combine with an Android emulator (to spoof GPS location), and a fake facebook to be literally anybody, anywhere, and see who likes you. While it's certainly not the intended use of the app, A/B testing your appearance to different regions is not out of the question.