Grindr gay-dating app exposed millions of users’ private data, messages, locations

Minimalist · Mar 31, 2018

According to an NBC report, the Grindr gay-dating app was affected by 2 security issues (now patched) that could expose the information of its more than 3 million daily users.
Click to expand...

https://securityaffairs.co/wordpress/70851/hacking/grindr-gay-dating-app-issues.html

Minimalist · Apr 3, 2018

Grindr Under Fire for Sharing HIV Status of Users

Same-sex dating app Grindr has said it will stop sharing users’ HIV status after it was revealed that the details were shared with third-party analytics companies.

According to initial research by Antoine Pultier, a researcher at SINTEF, and verified by Buzzfeed News, Grindr shared HIV status along with users’ GPS data, sexuality, relationship status, ethnicity, phone ID and email to Apptimize and Localytics, which help optimize apps. This information, unlike the HIV data, was sometimes shared via plain text.
Click to expand...

https://www.infosecurity-magazine.com/news/grindr-sharing-hiv-status-users/

guest · Sep 15, 2018

Privacy: Grindr API is STILL exposing the location of its users
September 15, 2018
https://betanews.com/2018/09/15/grindr-api-user-location/

Using a trilateration technique, and exploiting the fact that Grindr lets users know -- with some degree of accuracy -- how far away they are from others, it is very easy for just about anyone to build a tool that shows precise locations.

The privacy risk was brought to light by Queer Europe in an article on its website, and a video shared on Twitter: [...]

Back in March -- after the last privacy controversy -- Grindr issued a statement saying that it takes user security very seriously. But as Queer Europe demonstrates, by providing unfettered API access, Grindr facilitates tools that can pinpoint the location of users to between 2 and 5 meters.

The author of the blog post notes: "I was able to locate cruising men with an accuracy of two to five meters, which is very precise, and accurate enough to determine in which house and room users are located. The reason why these locations can be determined so precisely, is that Grindr uses a geohash of 12 characters to locate users, which equals to a 'square on an atlas' of 37×18 centimeters."
Click to expand...

guest · Mar 27, 2019

Exclusive: Told U.S. security at risk, Chinese firm seeks to sell Grindr dating app
March 27, 2019
https://www.reuters.com/article/us-...o-divest-the-dating-app-sources-idUSKCN1R809L

Chinese gaming company Beijing Kunlun Tech Co Ltd is seeking to sell Grindr LLC, the popular gay dating app it has owned since 2016, after a U.S. government national security panel raised concerns about its ownership, according to people familiar with the matter.
The United States has been increasingly scrutinizing app developers over the safety of personal data they handle, especially if some of it involves U.S. military or intelligence personnel.

Grindr, which describes itself as the world’s largest social networking app for gay, bisexual, transgender and queer people, had 27 million users as of 2017. The company collects personal information submitted by its users, including a person’s location, messages, and in some cases even someone’s HIV status, according to its privacy policy.
Click to expand...

guest · May 14, 2019

mood said: ↑

Exclusive: Told U.S. security at risk, Chinese firm seeks to sell Grindr dating app
March 27, 2019
https://www.reuters.com/article/us-...o-divest-the-dating-app-sources-idUSKCN1R809L
Click to expand...

China's Kunlun Tech agrees to U.S. demand to sell Grindr gay dating app
May 14, 2019
https://www.nbcnews.com/feature/nbc-out/china-s-kunlun-tech-agrees-u-s-demand-sell-grindr-n1005386

Kunlun's decision came after Reuters reported in March that CFIUS, an interagency government committee that scrutinizes acquisitions of U.S. companies for potential national security risks, had asked Kunlun to divest Grindr, whose database contains personal information such as a user's location, messages, and HIV status.

The development is a rare, high-profile example of CFIUS undoing an acquisition that has already been completed. Kunlun took over Grindr through two separate deals between 2016 and 2018 without submitting the acquisition for CFIUS review.
CFIUS has not disclosed its specific concerns. However, the United States has been increasingly scrutinizing app developers over the safety of personal data they handle, especially if some of it involves U.S. military or intelligence personnel.

In addition, CFIUS has barred Kunlun from accessing Grindr's personal data and from sending any of Grindr's data to people or entities in China.
Click to expand...

guest · May 27, 2019

Grindr's owner gave staff access to sensitive user data
The US pushed for the selloff after learning of the privacy issue
Max 26, 2019
https://www.engadget.com/2019/05/26/grindr-owner-selloff-explained/

Now, however, the situation is clearer. Reuters sources have claimed that Beijing Kunlun triggered alarms after it gave engineers in Beijing access to Grindr's database for several months.
While there wasn't evidence that the company misused the data, the tipsters believe the Committee on Foreign Investment in the United States (CFIUS) was worried that the Chinese government could comb the database to find info on US intelligence and military personnel.

The explanation still leaves Grindr with an uncertain fate, but it does shed light on just why the US was nervous. It also reflects the US government's increasingly strict approach to Chinese companies -- it doesn't want even the slightest risk of China's having access to private information.
Click to expand...

guest · Aug 10, 2019

Gay dating apps still leaking location data
August 8, 2019
https://www.bbc.co.uk/news/technology-49265245

In a demonstration for BBC News, cyber-security researchers were able to generate a map of users across London, revealing their precise locations.
This problem and the associated risks have been known about for years but some of the biggest apps have still not fixed the issue.

After the researchers shared their findings with the apps involved, Recon made changes - but Grindr and Romeo did not.

"We think it is absolutely unacceptable for app-makers to leak the precise location of their customers in this fashion. It leaves their users at risk from stalkers, exes, criminals and nation states," the researchers said in a blog post.
Grindr told BBC News users had the option to "hide their distance information from their profiles".
It added Grindr did obfuscate location data "in countries where it is dangerous or illegal to be a member of the LGBTQ+ community". However, it is still possible to trilaterate users' exact locations in the UK.
Click to expand...

guest · Mar 6, 2020

Grindr's Chinese owner says to sell social media app for $608 million
March 6, 2020
https://www.reuters.com/article/us-...ocial-media-app-for-608-million-idUSKBN20T0IR

Chinese gaming company Beijing Kunlun Tech Co Ltd (300418.SZ) said on Friday that it has agreed to sell Grindr LLC, a popular gay dating app it acquired in 2016, for about $608.5 million.

The deal comes after a U.S. government panel set a June 2020 deadline to sell the app. The panel, dubbed the Committee on Foreign Investment in the United States (CFIUS), has not disclosed its concerns about Kunlun’s ownership of Grindr.
However, the United States has been increasingly scrutinizing app developers over the safety of personal data they handle, especially if some of it involves U.S. military or intelligence personnel.

Kunlun said it agreed to sell its 98.59% stake in Grindr to San Vicente Acquisition LLC.
Click to expand...

Kunlun’s control of Grindr has fueled concerns among privacy advocates in the United States.
Reuters reported last year that Kunlun had given some Beijing-based engineers access to the personal information of millions of Americans, including private messages and HIV status.
Click to expand...

guest · Oct 3, 2020

Stealing Grindr Accounts Was a Matter of Knowing the Email Address
October 3, 2020
https://www.technadu.com/stealing-grindr-accounts-matter-knowing-email-address/215026/

A severe security flaw in Grindr would allow anyone with a valid user email address to reset the password and take over the account. This was discovered by security researcher Wassime Bouimadaghene, who reported the flaw to the app developers but was initially ignored. He then reached out to Troy Hunt of Have I Been Pwned, who managed to eventually find someone working on Grindr’s security team and pass them the exploit process’s details.

Knowing the email address and now the password, too, means that the actor can log in to another person’s Grindr account, as simple as that. There are no limits of any kind once this happens, as we’re talking about full account takeover. All information, media, and the ability to communicate with other users on the platform are available to the infiltrator as if he were the account holder.
Considering the nature of Grindr, this is extremely bad for its users.
Click to expand...

It took Grindr an unjustifiably long time to respond to Wassime’s report, and even Hunt’s messages, but at least they fixed the flaw almost immediately once they realized their blunder.
As Grindr’s chief operating officer Rick Marini told TechCrunch: [...]
Click to expand...

wildlights · Dec 28, 2020

this is worrying

Log in or Sign up

Grindr gay-dating app exposed millions of users’ private data, messages, locations

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

wildlights Registered Member

Log in or Sign up

Grindr gay-dating app exposed millions of users’ private data, messages, locations

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

wildlights Registered Member

Useful Searches