By adminuser999!
Therefore I reverse engineered two dating apps.
Video and picture drip through misconfigured S3 buckets
Typically for photos or other asserts, some sort of Access Control List (ACL) will be set up. For assets such as for instance profile photos, a typical method of applying ACL will be:
The main element would act as a “password” to gain access to the file, additionally the password would simply be offered users whom require usage of the image. When it comes to an app that is dating it’s going to be whoever the profile is presented to.
We have identified several misconfigured S3 buckets on The League throughout the research. All photos and videos are unintentionally made general general public, with metadata such as which user uploaded them as soon as. Typically the software would have the pictures through Cloudfront, a CDN on top associated with the buckets that are s3. Unfortunately the underlying S3 buckets are severely misconfigured.
Side note: in so far as i can inform, the profile UUID is randomly created server-side as soon as the profile is done. To ensure right part is not likely to be very easy to imagine. The filename is managed by the customer; the server takes any filename. In your client app it’s hardcoded to upload.jpg .
Owner has since disabled listObjects that are public. Nevertheless, we nevertheless think there ought to be some randomness within the key. A timestamp cannot act as key.
internet protocol address doxing through website website link previews
Link preview is something this is certainly difficult to get appropriate in lot of messaging apps. Read more