1. kaiumkuakata@gmail.com : Ab kaium : Ab kaium
  2. akaskuakata@gmail.com : akas :
  3. mithukuakata@gmail.com : mithu :
  4. mizankuakata@gmail.com : mizan :
  5. habibullahkhanrabbi@gmail.com : rabbi :
  6. amaderkuakata.r@gmail.com : rumi sorif : rumi sorif
শনিবার, ০১ অক্টোবর ২০২২, ০৫:৩২ অপরাহ্ন
প্রতিটি জেলা উপজেলায় প্রতিনিধি নিয়োগ দেওয়া হবে। যোগাযোগঃ-০১৯১১১৪৫০৯১, ০১৭১২৭৪৫৬৭৪

Therefore I reverse engineered two dating apps.

  • আপডেট সময় মঙ্গলবার, ১২ জুলাই, ২০২২
  • ১৩ বার

Therefore I reverse engineered two dating apps.

Video and picture drip through misconfigured S3 buckets

Typically for photos or other asserts, some form of Access Control List (ACL) will be set up. For assets such as for instance profile photos, a typical method of implementing ACL will be:

The main element would act as a “password” to gain access to the file, plus the password would simply be offered users who require usage of the image. When it comes to a dating app, it’s going to be whoever the profile is presented to.

We have identified several misconfigured S3 buckets on The League through the research. All photos and videos are unintentionally made general general general public, with metadata such as which user uploaded them as soon as. Usually the application would obtain the pictures through Cloudfront, a CDN on top associated with the buckets that are s3. Unfortunately the s3 that is underlying are severely misconfigured.

Side note: in so far as i can inform, the profile UUID is randomly created server-side if the profile is done. To ensure right part is not likely to be very easy to imagine. The filename is managed because of the customer; the host takes any filename. In your client app its hardcoded to upload.jpg .

The seller has since disabled listObjects that are public. But, we nevertheless think there must be some randomness into the key. A timestamp cannot act as key.

internet protocol address doxing through website website website website link previews

Link preview is something this is certainly difficult to get appropriate in a complete large amount of messaging apps. You will find typically three techniques for website website link previews:

The League makes use of link that is recipient-side. Whenever a note includes a hyperlink to a outside image, the hyperlink is fetched on user’s unit as soon as the message is seen. This might effortlessly enable a harmful transmitter to submit an external image URL pointing to an attacker managed server, obtaining recipient’s ip if the message is exposed.

A much better solution may be simply to connect the image when you look at the message when it’s delivered (sender-side preview), or have actually the server fetch the image and place it when you look at the message (server-side preview). Server-side previews enables extra anti-abuse scanning. It may be a much better choice, but nevertheless maybe perhaps not bulletproof.

Zero-click session hijacking through talk

The software will often connect the authorization header to demands that don’t need verification, such as for instance Cloudfront GET needs. It will happily give fully out the bearer token in requests to domains that are external some instances.

One particular situations could be the outside image website link in chat messages. We already know just the application utilizes link that is recipient-side, as well as the demand towards the outside resource is performed in recipient’s context. The authorization header is roofed within the GET demand towards the image that is external. Therefore the bearer token gets leaked to your domain that is external. Whenever a harmful transmitter delivers a graphic website website website link pointing to an assailant managed server, not just do they get recipient’s internet protocol address, however they additionally obtain victim’s session token. This can be a critical vulnerability as it permits session hijacking.

Remember that unlike phishing, this attack doesn’t need the target to click the website website link. As soon as the message containing the image website link is seen, the software immediately leaks the session token into the attacker.

This indicates to be always a bug associated with the reuse of a okHttp client object that is global. It might be most readily useful if the designers ensure that the software just attaches authorization bearer header in demands towards the League API.



I didn’t find any especially interesting weaknesses in CMB, but that doesn’t suggest CMB is much more safe compared to League. (See Limitations and future research). Used to do find a security that is few into the League, none of which were specially hard to learn or exploit. I assume it truly is the mistakes that are common make over and over repeatedly. OWASP top anybody?

As customers we have to be careful with which companies we trust with your information.

Vendor’s reaction

Used to do be given a response that is prompt The League after giving them a message alerting them associated with the findings. The bucket that is s3 had been swiftly fixed. One other weaknesses had been patched or at the least mitigated in just a couple weeks.

I do believe startups could truly provide bug bounties. It really is a good motion, and even more importantly, platforms like HackerOne provide scientists a appropriate way to the disclosure of weaknesses. Unfortuitously neither of this two apps within the post has program that is such.

Restrictions and research that is future

This scientific studies are maybe maybe perhaps not comprehensive, and may never be viewed as a safety review. All of the tests in this article had been done regarding the system IO degree, and hardly any on the customer it self. Particularly, we did not test for remote rule execution or buffer overflow kind vulnerabilities. In future research, we’re able to look more in to the safety of this customer applications.

This may be finished with powerful analysis, making use of practices such as for instance:

আপনার ফেইসবুকে শেয়ার করুন।

এরকম আরো খবর
© এই সাইটের কোন নিউজ/ অডিও/ভিডিও কপি করা দন্ডনিয় অপরাধ।
Created By Hafijur Rahman akas