Penetration Test Report (OS3): tinder report

Tinder Security Audit
SSN Project 2013
Joris Claassen Leendert v. Duijn Mick Pouw Esan Wit
{Joris.Claassen,Leendert.vanDuijn,Mick.Pouw,Esan.Wit}@os3.nl
December 22, 2013
Abstract
Tinder is a dating app that is being used by many users on
a global scale. The Tinder application requires a Facebook
profile as well as GPS location to function properly. Tinder
claims not to share this information with other users. Since
personal information like sexual preferences or your location
is highly sensitive data it should be properly secured. This
audit focuses on testing whether or not Tinder uses avail-
able technologies to withstand common attacks. Whilst most
known leaks in Tinder appear to no longer be around there
are still some points of concern. It turns out that there is an
insecure connection which sends user preferences and GPS
data to an analytics company.
Contents
1 Introduction 2
2 Related Work 3
3 Materials and Methods 4
3.1 Static analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3.2 Network traffic . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3.2.1 HTTP(S) Proxies . . . . . . . . . . . . . . . . . . . . . 4
3.2.2 Realization . . . . . . . . . . . . . . . . . . . . . . . . 5
3.3 User authentication. . . . . . . . . . . . . . . . . . . . . . . . 5
4 Analysis 6
4.1 Offline analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 6
4.1.1 Libraries . . . . . . . . . . . . . . . . . . . . . . . . . . 6
4.1.2 API resources . . . . . . . . . . . . . . . . . . . . . . . 6
4.1.3 Local storage . . . . . . . . . . . . . . . . . . . . . . . 7
4.2 Dynamic analysis . . . . . . . . . . . . . . . . . . . . . . . . . 7
4.2.1 Secured traffic . . . . . . . . . . . . . . . . . . . . . . 7
4.2.2 Insecure traffic . . . . . . . . . . . . . . . . . . . . . . 8
4.2.3 Targeting authentication . . . . . . . . . . . . . . . . . 9
4.2.4 Replay attacks . . . . . . . . . . . . . . . . . . . . . . 9
4.2.5 Data retrieval . . . . . . . . . . . . . . . . . . . . . . . 10
4.3 Legal analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4.3.1 Dutch law . . . . . . . . . . . . . . . . . . . . . . . . . 11
4.3.2 European law . . . . . . . . . . . . . . . . . . . . . . . 11
4.3.3 Privacy concerns . . . . . . . . . . . . . . . . . . . . . 12
5 Conclusion 13
References 14
A Scripts 15
A.1 Sending a Tinder message . . . . . . . . . . . . . . . . . . . . 15
A.2 Retrieving user history . . . . . . . . . . . . . . . . . . . . . . 15
B Traces 15
B.1 Replay, chat message to friend . . . . . . . . . . . . . . . . . 15
B.2 Replay, chat message to stranger . . . . . . . . . . . . . . . . 16
C Contributions 18
1 Introduction
Dating apps are common place in society. Many dating apps include the
option to contact matched users and send text messages or images. Due to
theamountofpersonalinformationpotentiallyinvolvedinthematchmaking
process this a prime target for identity theft. If an app or service deals with
personalinformation,ithastoensurethesecurityofthisprivateinformation.
Since the Tinder application has a lot of users, it would be interesting to
check this security.
The user has to supply some information before using the app. This
includes a Facebook profile API credentials and eventually even GPS infor-
mation. The information that can be collected from the Facebook profile
could be valuable for eavesdroppers or third parties. Information like GPS,
the actual location of the end user.
In this paper we will look in to the risks of using Tinder, what informa-
tion is sent where and how securely this information is transported over the
internet. We also look into whether information is stored at a third party
or even Tinder itself.
We will first discuss the materials and methods we used to research
the Tinder application. We will then discuss the analysis we did on the
Tinderapplicationeg. theofflineandonlineanalysis. Wewilldiscusscertain
attacksandpossibleweaknessesoftheTinderimplementation. Wewillthen
draw a conclusion based on our results. We divided the research questions
into several sub questions. These will be handled in the analysis. The sub
questions we are going to answer are:
• Does Tinder implement HTTPS during communication?
• Does Tinder send privacy sensitive data to systems outside of Tinders
control (e.g. client devices)?
• Is the undocumented, proprietary Tinder API prone to leaking data?
• Is it possible to eavesdrop on conversations between users?
2
2 Related Work
We found some interesting articles and papers online, which inspired us to
do this research.
ThisresearchislooselybasedonsimilarresearchintotheGrindrapplication[1].
The researchers examined the security of the Grindr dating app and found a
serious error in the implementation of Grindr. The Tinder app is not based
on the Grindr application.
The first article on Tinder we found was an article on Quartz[2], describ-
ing a possible leak of data Tinder used to have. Tinder claimed these data
leaks “.. happen[s] as you’re developing products”, and was going to be
patched the same day. The issue was fixed only a week later. This leads us
to believe the data privacy of Tinder users is not one of their top priorities.
Recently security researcher Shaked Klein Orbach did an audit of the se-
curityintheTinderiOSapp[3]. HisfindingsincludedthecouplingofTinder
Photos and Facebook ID’s, due to excess data sent by Tinder. The Tinder
iOSapphasamatchingmechanism, whichallowstwousersto“match”each
other. OrbachusedtheearlierfoundFacebookID’stomatchpeopletoother
people who where not friends, thus bypassing the matching mechanism.
Our research will look into the practical security of the Tinder Android
app. Thiswillinclude,forexample,theimplementationofSSL,thepossibil-
ities of man in the middle attacks, eavesdropping on chat messages, identity
spoofing or setting up fake matches. When gathering the results of these
tests, we can get insight in the security of the Tinder implementation.
3
3 Materials and Methods
Our research focuses on several particular attack vectors against the plat-
form. We will analyze several aspects of the application. User authentica-
tion, authentication of API server(s), possible user-base enumeration, and
leaking of information via side channels. We will investigate this by using
a combination of static offline analysis of the program code and analysis of
live network traffic.
3.1 Static analysis
The static analysis of the Tinder application was by decompiling the source
files from a retrieved APK file using APK to Java1. This APK file has been
retrieved from a rooted android device. The decompiler used was the freely
available jd-gui[4].
The purpose of the static analysis is to extract some information on how
Tinder is implemented. We focus on which libraries are used, how commu-
nicationishandledandifthereareanyobviousflawsintheimplementation.
We will also attempt to extract the structure of their API for later use.
3.2 Network traffic
The network traffic was analyzed by using a Man in the Middle(MitM)
attack. To do this we setup an access-point using a laptop and airbase-ng2.
The access point would then forward all requests via iptables to our proxy.
3.2.1 HTTP(S) Proxies
To complete our MitM setup we needed to proxy HTTP(S) requests and
fake certificates for the various requested web resources. Because we wanted
to analyze all requests we chose to set our proxy in transparent setup as
opposed to defining the proxy in the WiFi settings. Reason for this is
that applications on Android don’t use the proxy as configured in the WiFi
settings. As such we required a proxy which could generate SSL certificates
for the various end-points requested by the application.
First we used the Burp suite[5]. This program sat as a proxy between
client and server but allowed the user to change the data in the middle.
This would allow us to change request and response data without having to
create a placeholder server. However it turned out that Burp did not have
the option to run com