MoTB #07: Reflected XSS vulns in yfrog

What is yfrog
“yfrog is a service run by ImageShack that lets you share your photos on and videos on Twitter.” (yfrog FAQ page)

Twitter affect
yfrog can be used to send tweets by uploading new photos, or posting comments on existing photos.
yfrog is using OAuth authentication method in order to utilize the Twitter API.

Popularity rate
A competitor to TwitPic in the Twitter photo sharing market. Owned and operated by the popular ImageShack photo sharing service provider – 4 twits

Vulnerability: Reflected Cross-Site Scripting in the Upload and Search pages.
Status: Patched.
Details: The yfrog picture upload page does not encode HTML entities in the “url” variable, which can allow the injection of scripts. Similar vulnerability exists in the “s” variable of the yfrog Search page.
This vulnerability could have allowed an attacker to send tweets on behalf of its victims.
Proof-of-Concepts:
http://yfrog.com/?url=xxx”>%3Cscript%3Ealert%28″xss”%29%3C%2Fscript%3E
http://yfrog.com/search.php?s=%3Cscript%3Ealert%28/xss/%29%3C%2Fscript%3E
Screenshots:

Vendor response rate
The vulnerabilities were fixed 3 hours after they were reported. Excellent – 5 twits.

MoTB #06: Multiple vulnerabilities in TwitPic

What is TwitPic
“TwitPic lets you share photos on Twitter.” (TwitPic home page)

Twitter affect
TwitPic can be used to send tweets by uploading new photos, sending them via email, or posting comments on existing photos.
TwitPic is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
Most popular Twitter photo sharing service. Most visited Twitter 3rd party website, according to Compete – 5 twits

Vulnerabilities
1) Cross-Site Request Forgery in the Email PIN Settings page.
Status: Patched.
Details: This vulnerability was reported by dblackshell. See dblackshell’s advisory for more details: http://insanesecurity.info/blog/twitpic-modern-twitter-backdoor

Few days before “Month of Twitter Bugs” has started, attackers found Britney Spears’ TwitPic email PIN number by using a brute force attack (which was also fixed by TwitPic).
Instead, they could have easily used this CSRF vulnerability in order to tweet the fake death announcement.

2) Cross-Site Request Forgery in the comments form.
Status: Patched
Details: The comments form on each TwitPic picture web page did not use authenticity code in order to validate that the HTTP request POST is coming from the TwitPic web application.
This could have been used by an attacker to send comments on behalf of its victims, which could have also tweet the comments in Twitter.

3) Persistent Cross-Site Scripting in the TwitPic profile page.
Status: Patched.
Details: This vulnerability was first reported to TwitPic on May 18th 2009, and posted on my blog.
TwitPic did not encode HTML entities in the information it imported from the Twitter profile, and displayed in the TwitPic profile.
Screenshot:

Vendor response rate
It took TwitPic only an hour to fix the vulnerabilities. Excellent – 5 twits.

In conclusion
TwitPic has a large user base, and I’m happy that they are taking security very seriously. They also take the blame when needed. I’ll keep using TwitPic as my main Twitter photo sharing service.

MoTB #04: CSRF in BigTweet

What is BigTweet
“BigTweet was developed by Scott Carter (@scott_carter) as a way to interact more effectively with various networks from the Web. When you click on the BigTweet bookmarklet, a window appears in the middle of your current web page. Use it to post to Twitter or FriendFeed and then return to what you were doing. It doesn’t get any faster.” (BigTweet home page)

Twitter affect
BigTweet can be used to send tweets from any web page by using a bookmarklet.
BigTweet is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
While Bigtweet is not on any of the top Twitter services lists, it has an easy to integrate bookmarklet interface – 1 twit

Vulnerability: Cross-Site Request Forgery in BigTweet upate.json.
Status: Patched.
Details: The bigtweet update.json web page did not use authenticity code in order to validate that the HTTP post is coming from the bigtweet web application.
Screenshots:

Note: While the proof-of-concept in the screenshots used the “xxx” twitter user, the page will actually send a tweet for the currently logged-in user (in the PoC – @avivra). Any bigtweet.com registered user could have been used instead of xxx.

Vendor response rate
Vulnerability was fully fixed 22 hours after it has been reported.
Scott Carter, the developer of BigTweet, is also the one who came up with the idea of having a security best practices document for API developers. Alex Payne from Twitter has written such document last week. Excellent – 5 twits.

Password Length and Complexity for Social Media Sites

July 1st was “Twittersec” day as coined by @hevnsnt over at I-Hacked.com to designate July 1st as change your Twitter password day. Why? Mostly because July is the “month of Twitter bugs” created by a security researcher in which he will announce a bug in a “3rd party Twitter application” everyday for the month of July to raise awareness on security issues with the Twitter API. Technically, this should be “month of 3rd party” Twitter bugs but whatever. Either way it will raise awareness about some of the security issues of Twitter and 3rd party applications.

ANYWAY, back to my point….I sent out some tweets about changing your Twitter password and now being a good time to use a password manager like Keepass to manage multiple, complex passwords for everything…not just social media sites. One problem though is that each site might have different password length and complexity requirements. This becomes an annoying issue when you choose a randomly generated password like I suggest when using a password manager. You will encounter many sites that have specific requirements and others that do not. Obviously, the longer and more complex the password is the harder it is to crack so I suggest going as long as you can. Sad that there are these limitations on certain sites (blame the site developers) but if you set your random password generator to a very large number (I recommend at least 20 with a mix of everything you can throw at it including white spaces if the site will let you), it’s as good as your going to get.

Keep in mind, some applications even supported by the site (like the Facebook app for BlackBerry and iPhone) might not like passwords over a certain length or even certain special characters…you will know once you use these apps. Also, I mention Keepass as a password manager because you can use it on a BlackBerry or Windows Mobile device as well…an iPhone version is being worked on. So here you go…max password lengths for the major social media sites:

Twitter
None. I tried a 500 character password with everything but white spaces and it worked.

Facebook
None. I tried a 1000 character password with everything but white spaces and it worked.

MySpace
10 characters! Wow…really bad. Now I know another reason MySpace sucks.

LinkedIn
16 characters! This is interesting. LinkedIn truncates the password to 16 characters! Even if you put in a password larger then 16 characters it will only use the first 16, you can actually see this when entering in a password. No user notification, no info about this in the ‘help’ section. Sneaky and evil.

YouTube
None. Your account is tied to your Google account so is kind of a pain to change…but I didn’t find any issues with length or complexity.

On another note…I wonder if Twitter and Facebook truncate the passwords at a certain length and don’t tell you? Not sure…but it would be interesting to find out. This is another bad design as a they could easily just hash the entire password (which is a certain manageable length) and the hash is stored in the database not the large character password. Does this mean that sites like MySpace and LinkedIn are storing passwords in clear text? Also, I have run into other sites (non-social network) that actually truncate the password because when you try to login with an overly complex password…you get denied! Then you enter the cycle of doom…resetting your password thinking you fat fingered that password to begin with over and over. :-/

Are social media password limitations working against you?
Finally, just a quick point on this. Social media sites like MySpace and LinkedIn should NEVER have any limitations on password length or complexity. Certain complexity restrictions (like white space or strange characters) I could understand since you would have to use these passwords on mobile devices and other integrated apps. However, there are no technical limitations of just hashing the passwords to a constant length…and we all know storing passwords in a database in clear text is never a good thing.

Shouldn’t these social media sites that you already give your personal information to be trying to protect you the user as best as they can by letting you set a long and complex password? Let’s hope MySpace and LinkedIn get better at this real soon!


MoTB #03: TwitWall Persistent XSS

What is TwitWall
“TwitWall is the easy-to-use, quick-to-blast-out, instant blog companion for Twitter. With TwitWall, you can embed your favorite videos and widgets, upload your photos, mp3 music or podcasts, – you name it..” (TwitWall home page)

Twitter affect
TwitWall can be used to send tweets and follow/unfollow other Twitter users.
TwitWall is using OAuth authentication token in order to utilize the Twitter API.

Popularity rate
Though it’s here since Summer 2008, it has yet to gain enough user base to get into any of the top twitter services lists – 0.5 twits

Vulnerability: Persistent Cross-Site in TwitWall entry view page.
Status: Patched.
Details: TwitWall allows HTML to be embedded in the wall entries. According to the vendor this was done because “our users with non-malicious intentions enjoy using our html editor”. Unfortunately, the entry view page does not santize scripts and events that came along with the HTML.
This vulnerability could have allowed an attacker to send tweets, follow/unfollow others on behalf of its victims.
Screenshots:

Vendor response rate
Vulnerability was fully fixed 20 hours after it has been reported. Excellent – 5 twits.

MoTB #02: Reflected XSS in HootSuite

What is HootSuite
“HootSuite is the ultimate Twitter toolbox. With HootSuite, you can manage multiple Twitter profiles, add multiple editors, pre-schedule tweets, and measure your success. HootSuite lets you manage your entire Twitter experience from one easy-to-use interface.” (HootSuite about page)

Twitter affect
HootSuite can be used to send tweets, direct messages and follow/unfollow other Twitter users from multiple Twitter accounts.
HootSuite is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
27th place in the Top 100 Twitter Services, according to “The Museum of Modern Betas” – 3.5 twits

Vulnerability: Reflected Cross-Site in the “add-acount” page.
Status: Patched.
Details: The HootSuite “add-account” page does not encode HTML entities in the “pageMode”
variable, which can allow the injection of scripts.
This vulnerability could allowed an attacker to send tweets, direct messages and to follow/unfollow others on behalf of its victims.
Proof-of-Concept: http://hootsuite.com/twitter/add-account?height=240&width=280&modal=true&pageMode=xxx%22%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E
Screenshot:

Vendor response rate
Vulnerability was fixed two hours after it has been reported. Excellent – 5 twits.

MoTB #01: Multiple vulnerabilities in bit.ly service

What is bit.ly
“bit.ly allows users to shorten, share, and track links (URLs). Reducing the URL length makes sharing easier. bit.ly can be accessed through our website, bookmarklets and a robust and open API. bit.ly is also integrated into several popular third-party tools such as Tweetdeck.” (bit.ly about page)


Twitter affect
bit.ly can be used to send tweets with the shortened URLs through a form on their website, or a simple GET request.
bit.ly is using the OAuth authentication tokens in order to send tweets via the Twitter API.

Popularity rate
Second most popular URL shortening service in the wild – 4.5 twits

Vulnerabilities
1) Reflected Cross-Site Scripting in the “url” query parameter.
Status: Patched.
Details: This vulnerability was first reported by Mario Heiderich on May 18th 2009, on twitter.
A week later, I found that this vulnerability got fixed. Unfortunately, after playing with it a bit, I figured that it was only partially fixed. Instead of encoding the HTML entities, bit.ly developers have decided to strip the <> characters. E.g. this proof-of-concept would have popup an alert on IE7:
htttp://bit.ly/?url=”%20style=”color:expression(document.body.onload=function()%20{alert(1)})
The following is the screenshot of the PoC:

Several days ago, after a long discussion with Mario, bit.ly has finally fully fixed this vulnerability.

2) Reflected Cross-Site Scripting in the keywords parameter.
Status: Patched.
Details: This vulnerability was reported by Mike Bailey on June 24th 2009. See Mike’s advisory for more details: http://skeptikal.org/2009/06/parsing-quirk-causes-bitly-xss.html
This vulnerability was fixed by bit.ly yesterday.

3) Reflected POST Cross-Site Scripting in the username field of the login page
Status: Patched
Details: This vulnerability was reported by Mario Heiderich. See Mario’s advisory for more details: http://heideri.ch/bit.ly.txt
This vulnerability was fixed by bit.ly yesterday.

4) Persistent Cross-Site Scripting in the content-type field of the URL info page
Status: *Unpatched* Patched.
Details: This vulnerability was submitted by Mike Bailey on June 25th 2009.
Whenever a URL of a website gets shortened by bit.ly service, an information page is created for the URL, with statistics and metadata about the website.
One of the metadata information being stored by bit.ly is the content-type response header of the shortened URL page. This information of-course can be easily changed.
bit.ly fails to encode HTML entities while displaying the content-type information, and therefore allows injection of scripts to the page.
Live proof-of-concept can be found here: http://bit.ly/info/JvH83
Screenshot of the PoC (just in case the live demo will be removed):

Vendor response rate
It took bit.ly a month and a half to fix simple XSS vulnerabilities. Very poor – 0.5 twits.

In conclusion
bit.ly has a large user base (who doesn’t click bit.ly links?). However, with such a poor response rate to security vulnerabilities, and with such a poorly coded website, in terms of security, we can only hope for the best. Please be careful clicking those shortened URLs…

[Update – 3 hours into Month of Twitter Bugs] bit.ly have finally fixed the last vulnerability.

A Few Clarifications

Why bother highlighting privacy problems on Facebook?  Isn’t privacy just an illusion anyway? With the way Facebook currently operates, users should probably assume that advertisers, developers, and hackers can access all of the information they post. However, most users are not aware of this, and fully believe in the privacy controls Facebook provides. Facebook needs to address privacy problems to match user confidence or better educate users on how easily others can access their data.

Hasn’t Facebook patched the holes that allow access to profile data? Those behind FBHive.com should be commended for the privacy hole they uncovered, which Facebook did patch. However, the privacy problems mentioned here remain unpatched. SuperPoke has patched the specific hole used in my demonstration hack, but other applications are still vulnerable to an identical attack.

Aren’t you simply highlighting problems in Facebook applications? Isn’t Facebook itself more secure? Mark it down: A vulnerability in a Facebook application is a vulnerability in Facebook itself. Since all applications are granted access to a wealth of user information and can perform many actions that directly affect a user, application holes can be exploited to the point of differing little from actually hacking a user’s profile.

Are these hacks really that serious if they require a user to click a special link? Hacks that do not require user intervention are certainly more powerful. However, many security researchers will affirm that getting a user to click on a link is not that difficult. Also, many of these hacks can work invisibly on what appears to be an otherwise harmless page. Finally, applications have many viral channels available to them, and these can be exploited by an application attack or a rogue application to compromise more users.

Doesn’t Facebook prevent advertisers from accessing personally identifiable information? For advertisements served by Facebook itself, the site does prevent such access. Unfortunately, several advertising networks for Facebook applications, such as SocialCash, can and do access personally identifiable information for targeting their ads. While this appears to be a clear TOS violation, Facebook has not shown interest in addressing this particular problem.  Two ad networks were shut down recently, but apparently for deceptive ads and not for the user information they accessed.

Can Facebook enable third-party applications at all and still enforce user privacy? Security researchers may disagree on this particular question, but I do think it clear that Facebook could do far more to protect user privacy. The Facebook Platform currently ignores important security techniques that have led to problems such as my recent application hacks. For example, allowing every application full access to user information contributes to making the hacks so serious.

Instapaper Facebook Digg Twitter FriendFeed Delicious Yahoo Bookmarks Google Bookmarks

1 29 30 31 32 33 35