A newly published attack let researchers take over Tinder accounts with just a user’s phone number, according to a new report by Appsecure. Tinder has changed its login system to protect against the attack and there’s no evidence it was exploited before the patch. Still, it’s a reminder of how fragile many login systems still are, and how powerful even basic vulnerabilities can be when chained together.
The attack worked by exploiting two separate vulnerabilities: one in Tinder and another in Facebook’s Account Kit system, which Tinder uses to manage logins. The Account Kit vulnerability exposed users’ access tokens (also called an “aks” token), making them accessible through a simple API request with an associated phone number.
That should not have been enough for an account takeover by itself, but Tinder’s implementation of Account Kit had its own vulnerability. Tinder’s login system wasn’t verifying access tokens against their associated client ID, which meant anyone with a valid access token could take over an entire account. Chained together, the two vulnerabilities let researchers completely take over a Tinder account — with full access to the user’s profile and chats — starting from only a phone number.
Appsecure reported the vulnerability to both Facebook and Twitter earlier this year, and received awards of $5,000 and $1,250 through the companies’ respective bug bounty programs. Facebook and Tinder did not immediately respond to a request for comment.
The attack worked by exploiting two separate vulnerabilities: one in Tinder and another in Facebook’s Account Kit system, which Tinder uses to manage logins. The Account Kit vulnerability exposed users’ access tokens (also called an “aks” token), making them accessible through a simple API request with an associated phone number.
That should not have been enough for an account takeover by itself, but Tinder’s implementation of Account Kit had its own vulnerability. Tinder’s login system wasn’t verifying access tokens against their associated client ID, which meant anyone with a valid access token could take over an entire account. Chained together, the two vulnerabilities let researchers completely take over a Tinder account — with full access to the user’s profile and chats — starting from only a phone number.
Appsecure reported the vulnerability to both Facebook and Twitter earlier this year, and received awards of $5,000 and $1,250 through the companies’ respective bug bounty programs. Facebook and Tinder did not immediately respond to a request for comment.