Most dating apps for mobile phones vulnerable to hackers, says IBM Security

The IBM study reveals that many of these dating apps have access to additional features on mobile devices such as the camera, microphone, storage, Global Positioning System location and mobile-wallet billing information, which in combination with the vulnerabilities may make them exploitable to hackers.
IBM also found that nearly half of organisations analysed had at least one of these popular dating apps installed on mobile devices used to access business information.
Dating apps are a common and convenient way for singles of all ages to meet new love interests. In fact, a Pew Research study revealed that one in 10 Americans, or roughly 31 million people, had used a dating site or app and the number of people who dated someone they met online grew to 66 per cent.
Researchers at IBM Security identified that 26 of the 41 dating apps they analysed on the Android mobile platform had either medium or high severity vulnerabilities. The analysis was based on applications available in the Google Play app store last October.
The vulnerabilities discovered by IBM Security make it possible for a hacker to gather valuable personal information about a user.
While some apps have privacy measures in place, IBM found many were vulnerable to attacks such as malware, GPS information being used to track movements, stolen credit-card numbers, remote control of a device’s camera or microphone, and hijacking of a user’s dating profile.
- Dating App Used to Download Malware: Users let their guard down when they anticipate receiving interest from a potential date. That’s just the sort of moment that hackers thrive on. Some of the vulnerable apps could be reprogrammed by hackers to send an alert that asks users to click for an update or to retrieve a message that, in reality, is just a ploy to download malware onto their device.
- GPS Information Used to Track Movements: IBM found 73% of the 41 popular dating apps analyzed have access to current and past GPS location information. Hackers can capture a user’s current and past GPS location information to find out where a user lives, works, or spends most of their time.
- Credit Card Numbers Stolen From App: 48% of the 41 popular dating apps analyzed have access to a user’s billing information saved on their device. Through poor coding, an attacker could gain access to billing information saved on the device’s mobile wallet through a vulnerability in the dating app and steal the information to make unauthorized purchases.
- Remote Control of a Phone’s Camera or Microphone: All the vulnerabilities identified can allow a hacker to gain access to a phone’s camera or microphone even if the user is not logged into the app. This means an attacker can spy and eavesdrop on users or tap into confidential business meetings.
- Hijacking of Your Dating Profile: A hacker can change content and images on the dating profile, impersonate the user and communicate with other app users, or leak personal information externally to affect the reputation of a user’s identity. This poses a risk to other users, as well, since a hijacked account can be used by an attacker to trick other users into sharing personal and potentially compromising information.
To protect themselves against potential threats, IBM advises consumers to take the following steps.

lDon’t divulge too much personal information on these sites such as where you work, birthday or social-media profiles until you’re comfortable with the person you are engaging with via the app.
lFigure out if you want to use an app by checking the permissions it asks for.
lUse unique passwords for every online account you have.
lAlways apply the latest patches and updates to your apps and your device when they become available.
Use only trusted Wi-Fi connections when on your dating app.

Businesses also need to be prepared to protect themselves from vulnerable dating apps active inside their infrastructure, especially for bring-your-own-device (BYOD) scenarios.
- Leverage enterprise mobility management (EMM) offerings with mobile threat management (MTM) capabilities to enable employees to utilise their own devices while still maintaining the security of the organisation.
- Allow employees only to download applications from authorised app stores.
- Educate employees to know the dangers of downloading third-party applications and what it means when they grant that app specific device permissions.
- Set automated policies on smartphones and tablets that take immediate action if a device is found compromised or malicious apps are discovered.