Four major dating apps expose precise locations of 10 million users

August 13, 2019 TH Author

Four popular mobile applications offering dating and meetup services have security flaws which allow for the precise tracking of users, researchers claim.

This week, Pen Test Partners said that Grindr, Romeo, and Recon have all been leaking the precise location of users and it has been possible to develop a tool able to collate the exposed GPS coordinates.

The research builds upon a report released last week by Pen Test Partners that related to the safety of relationship application 3Fun.

3Fun, a mobile application for arranging threesomes and dates, had some of the “worst security for any dating app we’ve ever seen,” according to the team.

It was found that 3Fun was not only leaking the locations of users but also information including their dates of birth, sexual preferences, pictures, and chat data.

Bringing together 3Fun, Grindr, Romeo, and Recon, the team were able to create maps of user locations across the world by using GPS spoofing and trilateration — the use of algorithms based on longitude, latitude, and altitude to create a three-point map of a user’s location.

“By supplying spoofed locations (latitude and longitude) it is possible to retrieve the distances to these profiles from multiple points, and then triangulate or trilaterate the data to return the precise location of that person,” the researchers say.

Together, the security issues may impact up to 10 million users globally. The image below shows London users of the applications as an example:

Failure to secure and mask the true locations of users is problematic, but in some countries, these leaks could represent a real risk to individual safety.

As shown below in Saudi Arabia, for example, you can see users who may be persecuted for their sexual preferences — with particular reference to the LGBT+ community — as well as their overall sexual activities.

In some cases, the researchers said that locations of eight decimal places in latitude/longitude were reported, which suggests that highly accurate GPS data is being stored on servers.

The app developers were all notified of the researchers’ findings on June 1, 2019. Romeo responded within seven days and said there is already a feature enabled which allows users to move themselves to a rough position rather than utilize GPS.

However, this is not a default setting and users must enable it themselves.

CNET: Google now offers no-password login — if you have an Android phone

Recon said the issue has now been resolved by moving to a “snap to grid” setup.

A “snap to grid” system seems to be one of the most reasonable ways to resolve precise tracking. Rather than pinpointing the exact location of a user, this would “snap” a user to the nearest grid square, which provides a rough area and keeps the exact location of someone hidden from prying eyes.

Grindr did not respond to the disclosure. 3Fun worked with the researchers and requested advice on how to plug its data leak.

Pen Test Partners recommends that users should be given real, transparent options in how their location data is used so risk factors are known and understood.

TechRepublic: Famous con man Frank Abagnale: Crime is 4,000 times easier today

“It is difficult to for users of these apps to know how their data is being handled and whether they could be outed by using them,” the researchers say. “App makers must do more to inform their users and give them the ability to control how their location is stored and viewed.”

In related news this week, researcher Darryl Burke reported that the Chinese ‘version’ of Tinder, called Sweet Chat, has also been leaking chat content and photos via an unsecured server.

ZDNet has reached out to Grindr and will update if we receive a response.

Previous and related coverage

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0