{"id":36352,"date":"2020-07-29T17:47:20","date_gmt":"2020-07-29T17:47:20","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31440\/OKCupid-Fixed-Serious-Security-Vulnerability-After-Alert.html"},"modified":"2020-07-29T17:47:20","modified_gmt":"2020-07-29T17:47:20","slug":"okcupid-fixed-serious-security-vulnerability-after-alert","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/okcupid-fixed-serious-security-vulnerability-after-alert\/","title":{"rendered":"OKCupid Fixed Serious Security Vulnerability After Alert"},"content":{"rendered":"
<\/div>\n
\n

The popular online OKCupid dating service left the private details of its more than 50 million users in 110 countries vulnerable to hacking, reports Check Point this morning in a report.<\/p>\n

After discovering the potential for malicious actions, Check Point presented its findings to OKCupid, which fixed the security flaws in its servers within 48 hours of being notified. The dating service said not a single user was impacted by the potential vulnerability, which could have allowed a threat actor to masquerade as a user.<\/p>\n

At risk were full profile details, private messages, sexual orientation, personal addresses, and all submitted answers to OKCupid\u2019s profiling questions.<\/p>\n

Malicious actions, such as manipulating user profile data and sending messages, on behalf of a victim, without that user\u2019s knowledge, could have taken place, according to a Check Point report<\/a>.<\/p>\n

To carry out the attack, a threat actor could have executed malicious code into OkCupid web and mobile pages by generating a single, malicious link to send users. Check Point researchers outlined the attack method in three steps:<\/p>\n