‘Trilateration’ vulnerability in dating app Bumble leaked users’ exact location

guest · Aug 26, 2021

‘Trilateration’ vulnerability in dating app Bumble leaked users’ exact location
Attack built on previous Tinder exploit earned researcher – and ultimately, a charity – $2k
August 26, 2021
https://portswigger.net/daily-swig/...dating-app-bumble-leaked-users-exact-location

A security vulnerability in popular dating app Bumble enabled attackers to pinpoint other users’ precise location.

Bumble, which has more than 100 million users worldwide, emulates Tinder’s ‘swipe right’ functionality for declaring interest in potential dates and in showing users’ approximate geographic distance from potential ‘matches’.
Using fake Bumble profiles, a security researcher fashioned and executed a ‘trilateration’ attack that determined an imagined victim’s precise location.

As a result, Bumble fixed a vulnerability that posed a stalking risk had it been left unresolved.
Click to expand...

Robert Heaton, software engineer at payments processor Stripe, said his find could have empowered attackers to discover victims’ home addresses or, to some degree, track their movements.

However, “it wouldn't give an attacker a literal live feed of a victim’s location, since Bumble doesn't update location all that often, and rate limits might mean that you can only check [say] once an hour (I don't know, I didn't check),” he told The Daily Swig.
Click to expand...

As part of his research, Heaton developed an automated script that sent a sequence of requests to Bumble servers that repeatedly relocated the ‘attacker’ before requesting the distance to the victim.

“If an attacker (i.e. us) can find the point at which the reported distance to a user flips from, say, 3 miles to 4 miles, the attacker can infer that this is the point at which their victim is exactly 3.5 miles away from them,” he explains in a blog post that conjured a fictional scenario to demonstrate how an attack might unfold in the real world.
Click to expand...

Log in or Sign up

‘Trilateration’ vulnerability in dating app Bumble leaked users’ exact location

guest Guest

Log in or Sign up

‘Trilateration’ vulnerability in dating app Bumble leaked users’ exact location

guest Guest

Useful Searches