IBM Report Details Potential Vulnerabilities That Could Compromise Mobile Security 
 
 New technology has completely revolutionized the dating process. Many people are using mobile dating applications to find their “special someones.” In fact, a recent Pew Research study found that 1 in 10 Americans have used a dating site or application, and the number of people who have dated someone they met online has grown to 66 percent over the past eight years. Even though many dating applications are relatively new to the market, Pew Research also found that an astonishing 5 percent of Americans who are in a marriage or committed relationship met their significant other online. 
 
 As the number of dating applications and registered users grows, so does their attractiveness to potential attackers. Powered by IBM Application Security on Cloud technology, a recent IBM analysis of dating applications revealed the following: 
 
 Nearly 60 percent of leading mobile dating applications they studied on the Android mobile platform are vulnerable to potential cyberattacks that could put personal user information and organizational data at risk. 
 
 For 50 percent of enterprises IBM analyzed, employee-installed popular dating applications were present on mobile devices that had access to confidential business data. 
 
 The goal of this blog is not to discourage you from using these applications. Rather, its goal is to educate organizations and their users on potential risks and mobile security best practices to use the applications safely. 
 
 Potential Exploits in Dating Apps 
 
 The vulnerabilities IBM discovered are more powerful than you might suspect. Some of them make it possible for cybercriminals to collect valuable personal information about you. Even though certain applications employ privacy measures, IBM found that many are vulnerable to attacks, which can let cybercriminals do the following: 
 
 Use GPS Information to Track Your Movements: IBM found that 73 percent of the 41 popular dating applications analyzed have access to current and historical GPS location information. Cybercriminals may capture your current and former GPS location details to find out where you live, work or spend most of your day. 
 
 Control Your Phone’s Camera or Microphone: Several identified vulnerabilities let cybercriminals gain access to your phone’s camera or microphone even when you aren’t logged in to dating applications. Such vulnerabilities can let attackers spy and eavesdrop on your personal activities or tap into data you capture on your cell phone camera in confidential business meetings. 
 
 Several identified vulnerabilities let cybercriminals gain access to your phone’s camera or microphone even when you aren’t logged in to dating applications. Such vulnerabilities can let attackers spy and eavesdrop on your personal activities or tap into data you capture on your cell phone camera in confidential business meetings. Hijack Your Dating Profile: A cybercriminal can change content and images on your dating profile, impersonate you, communicate with other application users from your account or leak personal information that could tarnish your personal and/or professional reputation. 
 
 How Do Attackers Exploit These Vulnerabilities? 
 
 Which specific vulnerabilities enable attackers to carry out the exploits mentioned above, permitting them to gain access to your confidential information? IBM’s security researchers determined 26 of the 41 dating applications analyzed on the Android mobile platform either had medium- or high-severity vulnerabilities, which included the following: 
 
 Cross-Site Scripting Attacks via Man in the Middle: This vulnerability can act as a gateway for attackers to gain access to mobile applications and other features on your devices. It can permit an attacker to intercept cookies and other information from your application via an insecure Wi-Fi connection or rogue access point, and then tap into other devices features the app has access to, such as your camera, GPS and microphone. 
 
 This vulnerability can act as a gateway for attackers to gain access to mobile applications and other features on your devices. It can permit an attacker to intercept cookies and other information from your application via an insecure Wi-Fi connection or rogue access point, and then tap into other devices features the app has access to, such as your camera, GPS and microphone. Debug Flag-Enabled Exploits: If Debug Flag is enabled on an application, it means a debug-enabled application on an Android device may attach to another application and read or write to the application’s memory. The attacker can then intercept information that flows into the application, modify its actions and inject malicious data into it and out of it. 
 
 If Debug Flag is enabled on an application, it means a debug-enabled application on an Android device may attach to another application and read or write to the application’s memory. The attacker can then intercept information that flows into the application, modify its actions and inject malicious data into it and out of it. Phishing Attacks via Man in the Middle: Attackers can offer up a fake login screen via dating applications to capture your user credentials so that when you try to log in to a site of their choosing, your credentials are disclosed to the attackers without your knowledge. Then, the attacker can reach out to your contacts, pretend to be you and send them phishing messages with malicious code that could potentially infect their devices. 
 
 What Can You Do to Protect Yourself Against These Exploits? 
 
 One of the primary challenges with dating apps is that they operate in a different fashion than other social media sites. Most social media sites encourage you to connect with people you already know. By definition, mobile dating applications encourage you to connect with people you don’t already know. So, what can you do to protect yourself? 
 
 Trust Your Instinct: As the old saying goes, “There are plenty of fish in the sea.” If people you’re engaging with online refuse to provide the same basic information they ask of you; if their photos and profile appear too good to be true; or if their profile information doesn’t seem to align with the type of person with whom you’re communicating, trust your instinct and move on. Until you get to know the person well, resist any efforts to meet him or her anywhere but in a public location with plenty of people around. 
 
 As the old saying goes, “There are plenty of fish in the sea.” If people you’re engaging with online refuse to provide the same basic information they ask of you; if their photos and profile appear too good to be true; or if their profile information doesn’t seem to align with the type of person with whom you’re communicating, trust your instinct and move on. Until you get to know the person well, resist any efforts to meet him or her anywhere but in a public location with plenty of people around. Keep Your Profile Lean: Don’t divulge too much personal information on these sites. Information such as where you work, your birthday or links to your other social media profiles should be shared only when you’re comfortable with someone. 
 
 Don’t divulge too much personal information on these sites. Information such as where you work, your birthday or links to your other social media profiles should be shared only when you’re comfortable with someone. Schedule a Routine “Permission Review:” On a routine basis, you should review your device settings to confirm your security settings haven’t been altered. For example, I once had my cell phone revert to “GPS-enabled” when I upgraded the software on my device, permitting another user to identify my precise geographical location via a chat application. Prior to the upgrade, GPS device-tracking had not been enabled. Thus, you need to be vigilant, because updating your applications can inadvertently reset permissions for device features associated with your address book or GPS data. You should be particularly vigilant after any software upgrade or updates are made. 
 
 On a routine basis, you should review your device settings to confirm your security settings haven’t been altered. For example, I once had my cell phone revert to “GPS-enabled” when I upgraded the software on my device, permitting another user to identify my precise geographical location via a chat application. Prior to the upgrade, GPS device-tracking had not been enabled. Thus, you need to be vigilant, because updating your applications can inadvertently reset permissions for device features associated with your address book or GPS data. You should be particularly vigilant after any software upgrade or updates are made. Use Unique Passwords for All Your Online Accounts: Be sure to use unique passwords for every online account you manage. If you use the same password for all your accounts, it can leave you open to multiple attacks should an individual account be compromised. Remember to always use different passwords for your email and chat accounts than for your social media profiles, as well. 
 
 Be sure to use unique passwords for every online account you manage. If you use the same password for all your accounts, it can leave you open to multiple attacks should an individual account be compromised. Remember to always use different passwords for your email and chat accounts than for your social media profiles, as well. Patch Immediately: Always apply the latest patches and updates to your applications and devices as soon as they become available. Doing so will address identified bugs in your device and applications, resulting in a more secure online experience. 
 
 Always apply the latest patches and updates to your applications and devices as soon as they become available. Doing so will address identified bugs in your device and applications, resulting in a more secure online experience. Clean Up Your Contact List: Review the contacts and notes on your devices. Sometimes, users attach passwords and notes about personal and business contacts in their address book, but doing so could prove embarrassing and costly if they fall into the wrong hands. 
 
 Review the contacts and notes on your devices. Sometimes, users attach passwords and notes about personal and business contacts in their address book, but doing so could prove embarrassing and costly if they fall into the wrong hands. Live Happily Ever After: When you’re fortunate enough to have found your special someone, go back to the dating site and delete or deactivate your profile rather than keeping your personal information available to others. And don’t forget to buy him or her a Valentine’s Day gift this year! 
 
 What Can Organizations Do to Protect Their Users? 
 
 In addition to encouraging employees to follow safe online practices, organizations need to protect themselves from vulnerable dating apps that are active inside their infrastructure. As referred to earlier, IBM found nearly 50 organizations sampled for this research had at least one popular dating app installed on either corporate-owned devices or bring-your-own devices (BYOD). To protect this sensitive data, organizations should consider the following mobile security activities: 
 
 Protect BYOD Devices: Leverage enterprise mobility management capabilities to enable employees to use their own devices to access the sites while maintaining organizational security. 
 
 Leverage enterprise mobility management capabilities to enable employees to use their own devices to access the sites while maintaining organizational security. Permit Employees to Download From Authorized App Stores Only: Allow employees to download applications solely from authorized application stores, such as Google Play, the Apple App Store and your organization’s app store, if applicable. 
 
 Allow employees to download applications solely from authorized application stores, such as Google Play, the Apple App Store and your organization’s app store, if applicable. Educate Employees About Application Security: Educate employees about the dangers of downloading third-party applications and the potential dangers that can result from weak device permissioning. 
 
 Educate employees about the dangers of downloading third-party applications and the potential dangers that can result from weak device permissioning. Act Immediately When a Device Is Compromised: Set automated policies on smartphones and tablets that take immediate action if a device is found compromised or malicious apps are discovered. This approach protects your organization’s data while the issue is remediated. 
 
 About This Research 
 
 IBM Security analysts from IBM’s Application Security Research team used IBM Application Security on Cloud to analyze the top 41 dating apps available on Android devices to identify vulnerabilities that can leave users open to potential cyberattacks and threats. Those apps were also analyzed to determine the granted permissions, unveiling a host of excessive privileges. To understand enterprise adoption of these 41 dating apps, app data was analyzed from IBM MaaS360. In advance of releasing this research to the public, IBM Security disclosed all affected app vendors identified with the research. To try a free 30-day trial of IBM Application Security on Cloud, please click here. 

 (Adds IAC comment, paragraphs 12-13) 
 
 Feb 11 The millions of people using dating apps on company smartphones could be exposing themselves and their employers to hacking, spying and theft, according to a study by International Business Machines Corp. 
 
 IBM security researchers said 26 of 41 dating apps they analyzed on Google Inc's Android mobile platform had medium or high severity vulnerabilities, in a report published on Wednesday. 
 
 IBM did not name the vulnerable apps but said it had alerted the app publishers to problems. 
 
 Dating apps have become hugely popular in the past few years due to their instant messaging, photo and geolocation services. About 31 million Americans have used a dating site or app, according to a 2013 Pew Research Center study. 
 
 IBM found employees used vulnerable dating apps in nearly 50 percent of the companies sampled for its research. Using the same phone for work and play, a phenomenon known as "bring your own device," or BYOD, means users and their employers are both open to potential cyberattacks. 
 
 "The trouble with BYOD is that, if not managed properly, the organizations might be leaking sensitive corporate data via employee-owned devices," said the IBM report. 
 
 IBM said the problem is that people on dating apps let their guard down and are not as sensitive to potential security problems as they might be on email or websites. 
 
 If an app is compromised, hackers can take advantage of users waiting eagerly to hear back from a potential love interest by sending bogus "phishing" messages to glean sensitive information or install malware, IBM said. 
 
 A phone's camera or microphone could be turned on remotely through a vulnerable app, which IBM warned could be used to eavesdrop on personal conversations or confidential business meetings. Vulnerable GPS data could also lead to stalking, and a user's billing information could be hacked to purchase things on other apps or websites. 
 
 IBM said it had not so far seen a rash of security breaches due to dating apps as opposed to any other kind of social media. 
 
 Meanwhile, it recommends that dating app users limit the personal information they divulge, use unique passwords on every online account, apply the latest software patches and keep track of what permissions each app has. 
 
 IAC/InterActiveCorp, which owns some of the most popular dating apps, said its services were not at risk. 
 
 "IBM tested IAC's dating apps - including Match, OkCupid, and Tinder - and they were not among the apps found to exhibit the cited vulnerabilities," the company said in a statement emailed to Reuters. (Reporting by Bill Rigby; Editing by Cynthia Osterman and Tom Brown) 

 February 11, 2015 11:25 PM 
 
 NEW YORK (CBSNewYork) — Are you looking for love this Valentine’s Day? 
 
 As CBS2’s Tracee Carrasco reported, there is a new warning that could leave dating app users heartbroken. 
 
 “I went on just one Tinder date,” said Kelly Geiling. “I met a guy for drinks and that was it.” 
 
 Many people are looking for love, and like Geiling, many turn to dating apps on their smartphones hoping to find it. 
 
 “I went through to try and find, like, a normal person,” Geiling said. 
 
 But now, daters need to worry about more than just finding a normal person. Hackers could be getting a hold of their personal information. 
 
 “I’m concerned that I never thought about that,” Geiling said. 
 
 According to new research from IBM Security, 60 percent of dating apps on mobile devices have security flaws that could allow a hacker to break in, install a virus on your phone — even steal a credit card or personal information. 
 
 “Your contacts list; it could be your stored images, or your pictures. They can actually also potentially access features on the device – so your camera, your microphone, even your GPS location,” said Michael Monticello, security intelligence director of IBM Security Services. 
 
 IBM Security found that 26 out of 41 dating apps that were tested put users at risk to hackers. 
 
 The first step in protecting yourself is not to share too much information, and also, Monitcello said, “understanding if there is a configuration or how your app actually works is pretty important.” 
 
 Also, you are advised always to make sure you use a trusted wi-fi connection. 
 
 IBM Security doesn’t want to discourage people from using dating apps to find love, but just wants to make sure people are aware of these security risks.
– As if online dating weren't fraught with enough pitfalls, an IBM study published yesterday found that 26 of 41 popular Android dating apps, or 63%, had "medium to severe" security vulnerabilities that could leave users open to hacks, Reuters reports. And almost half of the companies reviewed for the report had workers who tapped into such apps—and then used the same phone at work, opening up their employers to cyberissues as well. "Your contacts list … your stored images. [Hackers] can actually also potentially access features on the device—so your camera, your microphone, even your GPS location," says the security intelligence director of IBM Security, per CBS New York. How likely (and incredibly creepy) is that? The report reveals 73% of top dating apps can tell your past and present GPS locations, while 34% can get into your camera. Which means, on a not-so-romantic front, that hackers can possibly stalk your daily activity, scroll through images, and even take over your dating profile, IBM's Security Intelligence notes. And if the electronic intruders can hijack your camera and mic, they can potentially spy on business meetings and access sensitive company data on your phone. IBM says it doesn't want to discourage people from using the apps, but it preaches some common-sense tips: Don't give out too much personal info on dating sites, don't ignore the security updates and patches your phone occasionally asks you to make, and mix up your passwords for all online accounts and email addresses. (Maybe this informational STD app will keep hackers away.)