A group of researchers from the Belgian university KU Leuven has discovered vulnerabilities in the design of several popular dating apps, including Bumble and Hinge. These vulnerabilities allowed malicious users or stalkers to pinpoint the location of their victims down to 2 meters.
The Research Findings
The researchers analyzed 15 popular dating apps and found that six of them had the same vulnerability: Badoo, Bumble, Grindr, happn, Hily, and Hinge. While these apps do not share exact locations when displaying distance between users on their profiles, they use exact locations for the "filters" feature.
Oracle Trilateration Technique
To pinpoint the exact location of a target user, the researchers used a novel technique called "oracle trilateration." This technique works by roughly estimating the victim’s location based on the location displayed in their profile. The attacker then moves in increments until the oracle indicates that the victim is no longer within proximity, and this for three different directions.
The Vulnerability
According to the researchers, the vulnerability was due to the fact that these apps used exact locations for the filters feature, which made it possible for a malicious user to identify the near-by users. The researchers demonstrated that with this information, an attacker could pinpoint the location of a target user down to 2 meters.
The Impact
The impact of this vulnerability is significant, as it allows malicious users to potentially harass or stalk their victims in real-time. The researchers noted that the vulnerability was particularly concerning in areas with low population density, such as rural or suburban areas.
The Response from the Apps
When contacted by the researchers, Grindr stated that rounding users’ precise locations by three decimals was a feature, not a bug. Hinge and Badoo also responded to the researchers, stating that they were looking into the matter.
Conclusion
The discovery of these vulnerabilities highlights the importance of ensuring that dating apps prioritize user privacy and security. The use of exact locations for filters features is a recipe for disaster, as it allows malicious users to potentially harass or stalk their victims in real-time.
Affected Apps
- Badoo
- Bumble
- Grindr
- happn
- Hily
- Hinge
Recommendations
- Dating apps should prioritize user privacy and security by using approximate locations for filters features.
- Users should be aware of the potential risks associated with sharing their location on dating apps.
Related Topics
- Badoo
- Cybersecurity
- Grindr
- Happn
- Hily
- Hinge
- Privacy
- Security
