DragonI

Dangerous liaisons

We took the most popular dating apps and analyzed what sort of user data they were capable of handing over to criminals and under what conditions.

securelist.com|Sidney Fussell

It seems just about everyone has written about the dangers of online dating, from psychology magazines to crime chronicles. But there is one less obvious threat not related to hooking up with strangers – and that is the mobile apps used to facilitate the process. We’re talking here about intercepting and stealing personal information and the de-anonymization of a dating service that could cause victims no end of troubles – from messages being sent out in their names to blackmail.

We studied the following online dating applications:

• Tinder for Android and iOS
• Bumble for Android and iOS
• OK Cupid for Android and iOS
• Badoo for Android and iOS
• Mamba for Android and iOS
• Zoosk for Android and iOS
• Happn for Android and iOS
• WeChat for Android and iOS
• Paktor for Android and iOS

By de-anonymization we mean the user’s real name being established from a social media network profile where use of an alias is meaningless

Location — determining user location (“+” – possible, “-” not possible)

Stalking — finding the full name of the user, as well as their accounts in other social networks, the percentage of detected users (percentage indicates the number of successful identifications)

HTTP — the ability to intercept any data from the application sent in an unencrypted form (“NO” – could not find the data, “Low” – non-dangerous data, “Medium” – data that can be dangerous, “High” – intercepted data that can be used to get account management).

HTTPS — interception of data transmitted inside the encrypted connection (“+” – possible, “-” not possible).

Messages — access to user messages by using root rights (“+” – possible, “-” not possible).

TOKEN — possibility to steal authentication token by using root rights (“+” – possible, “-” not possible).