Cyber Security

Vulnerability in Bumble dating app reveals user’s exact location

Programming code abstract technology background of software developer and Computer script

A security vulnerability in popular dating app Bumble could have enabled attackers to pinpoint other users’ precise location. Using fake Bumble profiles, security researcher Robert Heaton fashioned and executed a ‘trilateration’ attack that determined an imagined victim’s specific location.

Though Bumble tells its users how far away they are from each other, the vulnerability could allow an attacker to see precisely where the user lives and where they are at the moment. 

In a blog post, Heaton outlined how an attacker would exploit the vulnerability after developing and running a trilateration attack test. 

Heaton reported the vulnerability to Bumble, who then quickly deployed a fix and added controls to prevent matching with or viewing users outside of a user’s match queue. 

“Vulnerabilities are inevitable in any software – especially mobile apps where delivering innovative new functionality more quickly than your competition can be a game-changer,” says Hank Schless, Senior Manager, Security Solutions at Lookout, a San Francisco, Calif.-based endpoint-to-cloud security company. 

From a consumer standpoint, you don’t want to hear that a dating app has a location-related vulnerability. However, the speed and efficiency at which Bumble was able to push an update that fixed this issue show the advantage of cloud-delivered services that can quickly push fixes out to users before any damage is done. If the user has automatic app updates turned on, which most people do at this point, then the fix was delivered without the user even knowing, and they can continue using a safer version of the app,” Schless adds. 

The incident sheds light on how important it is for enterprise organizations to understand if any vulnerable app versions exist in their mobile fleet, Schless explains. “Any vulnerability, regardless of the capability it gives an attacker who successfully exploits it, poses a risk to the overall enterprise security posture. This can get very tricky – especially in a bring-your-own-device (BYOD) scenario where employees will inevitably have highly personal apps, like Bumble, on their device and admins want to provide security without violating employee privacy.”

In addition to vulnerable app versions, security administrators also need to ensure that mobile apps don’t have far-reaching permissions that could pose risks, Schless says. “While many app permissions, such as access to the camera or your contacts, may seem innocuous from a personal standpoint, they could pose a risk from an enterprise perspective where data privacy laws like GDPR and CCPA are king.”

Schless suggests that organizations should leverage a mobile security solution that strikes a balance between security and privacy to mitigate the risk of vulnerable apps or risky permissions. “This means the solution can provide enough visibility to build policies based on app versions and permissions, but not so much that admins can see the apps causing the violations. This preserves employee privacy while also strengthening the overall security and compliance posture of the organization.”

Source: https://www.securitymagazine.com/articles/95979-vulnerability-in-bumble-dating-app-reveals-users-exact-location

Click to comment

You May Also Like

Cyber Security

Privileged users typically hold crucial positions within organizations. They usually have elevated access, authority, and permission levels in the organization’s IT systems, networks, applications,...

Cyber Security

The administration and its private sector partners announced a slate of new initiatives on Monday aimed at protecting the nation’s school systems and their...

Cyber Security

The plan includes measures for improving cybersecurity knowledge at all levels of education and improving how the federal government attracts, hires and pays cybersecurity...

Cyber Security

A new report noted that a lack of “established policies and procedures” could prevent the tax agency from meeting federal requirements. An Internal Revenue...

Copyright © 2023 Newsworthy News | Global | Political | Local | All News | Website By: Top Search SEO

Exit mobile version