Hi @KamalAditi,
Challenge accepted!
Please find below the first flaw of #Kimbho app 2.0 aka how to get the online status of #Bolo usershttps://twitter.com/KamalAditi/status/1017787551850131456 …
-
Show this thread
-
First thing first, we are talking about this app "Bolo Messenger - Secure Chat, Voice & Video Calls" which is the new version of the
#Kimbho app https://play.google.com/store/apps/details?id=com.bolo.chat …1 reply 7 retweets 49 likesShow this thread -
When you send a message with the
#Bolo app, it is checking if your contact is online with this request. The endpoint is taking the "contact userId" (the 1st black rectangle in the picture)pic.twitter.com/lEqch4vpFa
2 replies 6 retweets 53 likesShow this thread -
If the request is successful, you will receive this response with 2 info: - If the user is online - Last active time Let's try to have the status of someone which is not my contact!pic.twitter.com/Zlz6JjwYDS
1 reply 6 retweets 45 likesShow this thread -
In this other request, the app is putting your phone number in the "contacts" parameter. If the request is successful you will receive a response with your userId.pic.twitter.com/euB3xCcXjM
2 replies 5 retweets 42 likesShow this thread -
Magic time: 1) In the previous request, replace the "contacts" parameter by the phone number of someone which has a Bolo account 2) In the response, you will receive his userId 3) Use this userId in the 1st request I mentioned in the thread
1 reply 5 retweets 50 likesShow this thread -
Even if you don't have it on your contact list you will receive his online status and last active time. Not good for a so called "secure" chat app, nah? What do you think
@KamalAditi?6 replies 10 retweets 93 likesShow this thread -
Replying to @fs0c131y
That’s a shocker. You can do better than that. Wondering why whatsApp has the same security flaw, checkout this screenshot from whatsApp. This is an unknown number and I can see his status, omgpic.twitter.com/0pMt0VN9JA
11 replies 0 retweets 1 like -
Replying to @KamalAditi @fs0c131y
If I have any unknown number I can save and see his status. Don’t understand your finding in it. Let’s talk about real security threats and don’t misguide with silly findings.
5 replies 0 retweets 0 likes
“You don’t understand” this is well said. Ask to a professional maybe...
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.