Dating Site Bumble Leaves Swipes Unsecured for 100M Users

guest · Nov 21, 2020

Dating Site Bumble Leaves Swipes Unsecured for 100M Users
Bumble fumble: An API bug exposed personal information of users
November 16, 2020
https://threatpost.com/dating-site-bumble-swipes-unsecured-100m-users/161276/

After a taking closer look at the code for popular dating site and app Bumble, where women typically initiate the conversation, Independent Security Evaluators researcher Sanjana Sarda found concerning API vulnerabilities. These not only allowed her to bypass paying for Bumble Boost premium services, but she also was able to access personal information for the platform’s entire user base of nearly 100 million.

Sarda said these issues were easy to find and that the company’s response to her report on the flaws shows that Bumble needs to take testing and vulnerability disclosure more seriously.
Click to expand...

Bug Details

“It took me approximately two days to find the initial vulnerabilities and about two more days to come up with a proofs-of- concept for further exploits based on the same vulnerabilities,” Sarda told Threatpost by email. “Although API issues are not as renowned as something like SQL injection, these issues can cause significant damage.”
She reverse-engineered Bumble’s API and found several endpoints that were processing actions without being checked by the server.
Click to expand...

“After 225 days of silence from the company, we moved on to the plan of publishing the research,” Sarda told Threatpost by email. “Only once we started talking about publishing, we received an email from HackerOne on 11/11/20 about how ‘Bumble are keen to avoid any details being disclosed to the press.'”
HackerOne then moved to resolve some the issues, Sarda said, but not all of them.
Click to expand...

Log in or Sign up

Dating Site Bumble Leaves Swipes Unsecured for 100M Users

guest Guest

Log in or Sign up

Dating Site Bumble Leaves Swipes Unsecured for 100M Users

guest Guest

Useful Searches