Bumble fumble: Dude divines definitive location of dating app users despite disguised distances
(2021/08/26)
- Reference: 1629962887
- News link: https://www.theregister.co.uk/2021/08/26/bumble_location_leak/
- Source link:
Up until this year, dating app Bumble inadvertently provided a way to find the exact location of its internet lonely-hearts, much in the same way one could geo-locate Tinder users back in 2014.
In a [1]blog post on Wednesday, Robert Heaton, a security engineer at payments biz Stripe, explained how he managed to bypass Bumble's defenses and implement a system for finding the precise location of Bumblers.
"Revealing the exact location of Bumble users presents a grave danger to their safety, so I have filed this report with a severity of 'High,'" he wrote in [2]his bug report .
Tinder's past flaws explain how it's done
Heaton recounts how Tinder servers until 2014 sent the Tinder app the exact coordinates of a potential "match" – a prospective person to date – and the client-side code then calculated the distance between the match and the app user.
The problem was that a stalker could intercept the app's network traffic to determine the match's coordinates. Tinder responded by moving the distance calculation code to the server and sent only the distance, rounded to the nearest mile, to the app, not the map coordinates.
[3]
That fix was insufficient. The rounding operation happened within the app but the still server sent a number with 15 decimal places of precision. {
"user_id": 1234567890,
"distance": 5.21398760815170,
// ...etc...
}
While the client app never displayed that exact number, Heaton says it was accessible. In fact, Max Veytsman, a security consultant with Include Security back in 2014, was able to use the unnecessary precision to locate users via a technique called [4]trilateralization , which is similar to, but not the same as, triangulation.
This involved querying the Tinder API from three different locations, each of which returned a precise distance. When each of those figures were converted into the radius of a circle, centered at each measurement point, the circles could be overlaid on a map to reveal a single point where they all intersected, the actual location of the target.
[5]
[6]
The fix for Tinder involved both calculating the distance to the matched person and rounding the distance on its servers, so the client never saw precise data. Bumble adopted this approach but evidently left room for bypassing its defenses.
Bumble's booboo
Heaton in his bug report explained that simple trilateralization was still possible with Bumble's rounded values but was only accurate to within a mile – hardly sufficient for stalking or other privacy intrusions. Undeterred, he hypothesized that Bumble's code was simply passing the exact distance to a function like [7]math.round() and returning the result.
"This means that we can have our attacker slowly 'shuffle' around the vicinity of the victim, looking for the precise location where a victim's distance from us flips from (say) 1.0 miles to 2.0 miles," he explained.
"We can infer that this is the point at which the victim is exactly 1.0 miles from the attacker. We can find 3 such 'flipping points' (to within arbitrary precision, say 0.001 miles), and use them to perform trilateration as before."
[8]
Heaton subsequently determined the Bumble server code was using [9]math.floor() , which returns the largest integer less than or equal to a given value, and that his shuffling technique worked.
[10]Backdoorer the Xplora: Kids' smartwatches can secretly take pics, record audio on command by encrypted texts
[11]Israeli spyware maker NSO channels Hollywood spy thrillers in appeal for legal immunity in WhatsApp battle
[12]American schools' phone apps send children's info to ad networks, analytics firms
[13]Restoring your privacy costs money, which makes it a marker of class
To repeatedly query the undocumented Bumble API required some additional effort, specifically defeating the signature-based request authentication scheme – more of an inconvenience to deter abuse than a security feature. This proved not to be too difficult because, as Heaton explained, Bumble's request header signatures are generated in JavaScript that's accessible in the Bumble web client, which also provides access to whatever secret keys are used.
From there it was a matter of: identifying the specific request header ( X-Pingback ) carrying the signature; de-minifying a condensed JavaScript file; determining that the signature generation code is simply an MD5 hash; and then figuring out that the signature passed to the server is an MD5 hash of the combination of the request body (the data sent to the Bumble API) and the obscure but not secret key contained within the JavaScript file.
After that, Heaton was able to make repeated requests to the Bumble API to test his location-finding scheme. Using a Python proof-of-concept script to query the API, he said it took about 10 seconds to locate a target. He reported his findings to Bumble on June 15, 2021.
On June 18, the company implemented a fix. While the specifics were not disclosed, Heaton proposed rounding the coordinates first to the nearest mile and then calculating a distance to be displayed through the app. On June 21, Bumble awarded Heaton a $2,000 bounty for his find.
[14]
Bumble did not immediately respond to a request for comment. ®
Get our [15]Tech Resources
[1] https://robertheaton.com/bumble-vulnerability/
[2] https://hackerone.com/reports/1234406
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://en.wikipedia.org/w/index.php?title=True-range_multilateration&oldid=1031163653
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/round
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/floor
[10] https://www.theregister.com/2020/10/12/xplora_4_smartwatches/
[11] https://www.theregister.com/2020/11/17/israeli_hacking_group_goes_hollywood/
[12] https://www.theregister.com/2021/05/04/school_mobile_apps/
[13] https://www.theregister.com/2021/07/15/privacy_costs_money/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
In a [1]blog post on Wednesday, Robert Heaton, a security engineer at payments biz Stripe, explained how he managed to bypass Bumble's defenses and implement a system for finding the precise location of Bumblers.
"Revealing the exact location of Bumble users presents a grave danger to their safety, so I have filed this report with a severity of 'High,'" he wrote in [2]his bug report .
Tinder's past flaws explain how it's done
Heaton recounts how Tinder servers until 2014 sent the Tinder app the exact coordinates of a potential "match" – a prospective person to date – and the client-side code then calculated the distance between the match and the app user.
The problem was that a stalker could intercept the app's network traffic to determine the match's coordinates. Tinder responded by moving the distance calculation code to the server and sent only the distance, rounded to the nearest mile, to the app, not the map coordinates.
[3]
That fix was insufficient. The rounding operation happened within the app but the still server sent a number with 15 decimal places of precision. {
"user_id": 1234567890,
"distance": 5.21398760815170,
// ...etc...
}
While the client app never displayed that exact number, Heaton says it was accessible. In fact, Max Veytsman, a security consultant with Include Security back in 2014, was able to use the unnecessary precision to locate users via a technique called [4]trilateralization , which is similar to, but not the same as, triangulation.
This involved querying the Tinder API from three different locations, each of which returned a precise distance. When each of those figures were converted into the radius of a circle, centered at each measurement point, the circles could be overlaid on a map to reveal a single point where they all intersected, the actual location of the target.
[5]
[6]
The fix for Tinder involved both calculating the distance to the matched person and rounding the distance on its servers, so the client never saw precise data. Bumble adopted this approach but evidently left room for bypassing its defenses.
Bumble's booboo
Heaton in his bug report explained that simple trilateralization was still possible with Bumble's rounded values but was only accurate to within a mile – hardly sufficient for stalking or other privacy intrusions. Undeterred, he hypothesized that Bumble's code was simply passing the exact distance to a function like [7]math.round() and returning the result.
"This means that we can have our attacker slowly 'shuffle' around the vicinity of the victim, looking for the precise location where a victim's distance from us flips from (say) 1.0 miles to 2.0 miles," he explained.
"We can infer that this is the point at which the victim is exactly 1.0 miles from the attacker. We can find 3 such 'flipping points' (to within arbitrary precision, say 0.001 miles), and use them to perform trilateration as before."
[8]
Heaton subsequently determined the Bumble server code was using [9]math.floor() , which returns the largest integer less than or equal to a given value, and that his shuffling technique worked.
[10]Backdoorer the Xplora: Kids' smartwatches can secretly take pics, record audio on command by encrypted texts
[11]Israeli spyware maker NSO channels Hollywood spy thrillers in appeal for legal immunity in WhatsApp battle
[12]American schools' phone apps send children's info to ad networks, analytics firms
[13]Restoring your privacy costs money, which makes it a marker of class
To repeatedly query the undocumented Bumble API required some additional effort, specifically defeating the signature-based request authentication scheme – more of an inconvenience to deter abuse than a security feature. This proved not to be too difficult because, as Heaton explained, Bumble's request header signatures are generated in JavaScript that's accessible in the Bumble web client, which also provides access to whatever secret keys are used.
From there it was a matter of: identifying the specific request header ( X-Pingback ) carrying the signature; de-minifying a condensed JavaScript file; determining that the signature generation code is simply an MD5 hash; and then figuring out that the signature passed to the server is an MD5 hash of the combination of the request body (the data sent to the Bumble API) and the obscure but not secret key contained within the JavaScript file.
After that, Heaton was able to make repeated requests to the Bumble API to test his location-finding scheme. Using a Python proof-of-concept script to query the API, he said it took about 10 seconds to locate a target. He reported his findings to Bumble on June 15, 2021.
On June 18, the company implemented a fix. While the specifics were not disclosed, Heaton proposed rounding the coordinates first to the nearest mile and then calculating a distance to be displayed through the app. On June 21, Bumble awarded Heaton a $2,000 bounty for his find.
[14]
Bumble did not immediately respond to a request for comment. ®
Get our [15]Tech Resources
[1] https://robertheaton.com/bumble-vulnerability/
[2] https://hackerone.com/reports/1234406
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://en.wikipedia.org/w/index.php?title=True-range_multilateration&oldid=1031163653
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/round
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/floor
[10] https://www.theregister.com/2020/10/12/xplora_4_smartwatches/
[11] https://www.theregister.com/2020/11/17/israeli_hacking_group_goes_hollywood/
[12] https://www.theregister.com/2021/05/04/school_mobile_apps/
[13] https://www.theregister.com/2021/07/15/privacy_costs_money/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSdmZTiGhmPLFCf@37TsBgAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
Re: What?
Pascal Monett
When you're actually doing your job, you don't need to boast : the results speak for themselves.
Natalie Gritpants Jr
Take a tip from the audio engineers. Adding a random number (0.0 to 0.99999) and then using floor() is probably better than round().
Anonymous Coward
That's the obvious solution, kind of surprised they didn't reach for it first time. But fixed now. Nicely done by our Mr Heaton, and a good writeup here by Thomas - it's almost a textbook example of "hacking", for lack of a better term., deriving information that on first glance doesn't appear to be there.
My only confusion was finding what I'd always called triangulation is, in fact, something a bit different, and wondering how that Wikipedia page could make something I demonstrated to my 9yo with three bits of string so unfathomably complex.
John H Woods
Math-heavy pages on Wikipedia are way out of whack (technical term) with the tone and level of other technical content. All my attempts to contribute simplifications and explanations have been rejected.
seven of five
https://xkcd.com/2501/
Optional ize
John H Woods
Trilateration, surely, otherwise we would use the term triangularization?
Tipping point
Pascal Monett
After reading this article, I'd first like to say that even the Tinder flaw seems to me to be beyond the abilities of Joe Stalker to diagnose. The people who find these flaws are really on the top of their game. Kudos to them.
That being said, that triangulation thing seems to be a bit difficult to avoid. Even if you fudge the distance a bit, you're still informing a stalker of a distance that is an easy walk away.
I think such apps should not inform of distance directly, but rather use categories like Close By, Within Driving Distance, Far Away. Category calculated on the server, obviously.
Maybe that would solve the issue ?
Re: Far away
DJV
Unless you're talking about cows... [1]https://www.youtube.com/watch?v=MMiKyfd6hA0
[1] https://www.youtube.com/watch?v=MMiKyfd6hA0
What?
No self-serving PR statement about how highly they value their customers' privacy?
(Though apparently they do, considering how fast they implemented a fix and didn't argue)