The checkpoint research team reported a slew of flaws in OkCupid’s popular dating app, allowing attackers to collect users’ sensitive information, change their profile, or even send messages from their profile. Cybersecurity experts reacted below on this research.
Experts Comments
July 30, 2020
This story is rather alarmist as the vulnerabilities described have been fixed by OkCupid. In fact, they state that they were grateful for the information and took steps to mitigate the threats within 48 hours. Furthermore, it would appear there was no evidence to suggest any user data was breached. As a platform provider, they have acted swiftly and properly although they ought to have been checking their App and webpage regularly for bugs and flaws themselves. Mobile dating apps are.....Read More
Like(
July 30, 2020
With the ability to send messages to users, the chances of social engineering within the application are high. There is both a mobile and web interface which gives attackers the possibility to script sending messages to various users with the aim of compromising user profiles. Setting up fake accounts with attractive photos has been used before in phishing attacks and could certainly be used again. Once an account is compromised, the attackers could use that account to facilitate additional.....Read More
July 30, 2020
Like most XSS issues involving social engineering, an attacker would need to distribute a malicious link to users, and users would need to click on it. Normally this works only when the user is already logged in to a web application.
In this case, the Android app is configured to automatically open OkCupid-related URLs the user clicks on. As such, if an attacker manages to send specially crafted URLs to mobile users (e.g., via a chat application), then upon clicking these links, the OkCupid.....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Chris Hauk, Consumer Privacy Champion, provides expert commentary at @Information Security Buzz.
"Dating app users should carefully research any dating app\'s privacy policy before signing up...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-reaction-om-okcupid-app-web-security-flaws-discovered
Facebook Message
@Chris Hauk, Consumer Privacy Champion, provides expert commentary at @Information Security Buzz.
"Dating app users should carefully research any dating app\'s privacy policy before signing up...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-reaction-om-okcupid-app-web-security-flaws-discovered