Imagine running a dating app and being told accounts could be easily hijacked. How did that feel, Grindr?
In brief LGBTQ dating site Grindr has squashed a security bug in its website that could have been trivially exploited to hijack anyone’s profile using just the victim’s email address.
French bug-finder Wassime Bouimadaghene spotted that when you go to the app’s website and attempt to reset an account’s password using its email address, the site responds with a page that tells you to check your inbox for a link to reset your login details – and, crucially, that response contained a hidden token.
It turned out that token was the same one in the link emailed to the account owner to reset the password. Thus you could enter someone’s account email address into the password reset page, inspect the response, get the leaked token, construct the reset URL from the token, click on it, and you’d get to the page to enter a new password for the account. And then you control that user’s account, can go through its pics and messages, and so on.
After reporting the blunder to Grindr and getting no joy, Bouimadaghene went to Aussie internet hero Troy Hunt, who eventually got hold of people at the software maker, the bug got fixed, and the tokens were no longer leaking out.
“This is one of the most basic account takeover techniques I’ve seen. I cannot fathom why the reset token – which should be a secret key – is returned in the response body of an anonymously issued request,” said Hunt. “The ease of exploit is unbelievably low and the impact is obviously significant, so clearly this is something to be taken seriously.”
“We believe we addressed the issue before it was exploited by any malicious parties,” Grindr told TechCrunch.
SEC Consult has warned that SevOne‘s Network Management System can be compromised via command injection, SQL injection, and CSV formula injection bugs. No patch is available as the infosec biz was ignored when it tried to privately report the holes.
Meanwhile, someone is deliberately disrupting the Trickbot botnet, said to be made up of more than two million infected Windows PCs that harvest people’s financial details for fraudsters and sling ransomware at others.
Treasury warns: Don’t cave to ransomware demands, it could cost you
The US Treasury this week sent out a warning to cyber-security companies, er, well, at least those in the States: paying cyber-extortionists’ demands on behalf of a client is definitely not OK, depending on the circumstances.
Officials reminded Americans [PDF] that agreeing to pay off ransomware crooks in sanctioned countries is a crime, and could run afoul of the rules set by the Office of Foreign Assets Control (OFAC), even if it’s in the service of a client. Bear in mind this is an advisory, not a legal ruling.
“Companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations,” the Treasury said.
Ballers rolled for social account details
As if the distancing bubbles in sports and constant COVID-19 virus tests aren’t enough for professional athletes, they have to look out for miscreants on the web, too.
The Feds this week accused Trevontae Washington, 21, of Thibodaux, Louisiana, and Ronnie Magrehbi, 20, of Orlando, Florida, of hijacking internet profiles of football and basketball players. According to prosecutors:
And…
The pair were charged with conspiracy to commit wire fraud, and conspiracy to commit computer fraud and abuse. ®
READ MORE HERE