Critical OkCupid Flaw Exposes Daters to App Takeovers

guest · Feb 14, 2019

Critical OkCupid Flaw Exposes Daters to App Takeovers
February 14, 2019
https://threatpost.com/critical-okcupid-flaw-exposes-daters-to-app-takeovers/141794/

A critical flaw in the OkCupid app has been found that could allow a bad actor to steal credentials, launch man-in-the-middle attacks or completely compromise the victim’s application.

The newly disclosed vulnerability is incredibly easy to exploit, and yet has serious consequences: Attackers can monitor the app’s usage, read all messages and even track the victim’s geographic location, researchers with Checkmarx, who discovered the flaw, said on Thursday.
Vulnerability in WebView
The vulnerability exists in OkCupid’s Android app, which uses a “WebView,” i.e., a browser bundled inside of a mobile application. This produces what is called a hybrid app.
Attacks Varying in Severity
At the most simple level, this flaw sets up the perfect attack vector for phishing techniques, researchers said. An attacker could very simply create a page with a URL containing /l/, and send it to an unsuspecting victim as an internal OkCupid message.
However, the vulnerability also exposes daters to several much more damaging attacks.
Click to expand...

Log in or Sign up

Critical OkCupid Flaw Exposes Daters to App Takeovers

guest Guest

Log in or Sign up

Critical OkCupid Flaw Exposes Daters to App Takeovers

guest Guest

Useful Searches