Social Zombies Invade Las Vegas!

zombieYes, you are reading the title of this post correctly!  Massive Zombie attacks at DefCon this year…bring your shotgun (we are kidding of course, please do not bring firearms to DefCon…you will make the goons very unhappy)!  Seriously though, Kevin Johnson and I will be presenting “Social Zombies: Your Friends Want to Eat Your Brains” at DefCon 17 in Las Vegas on Sunday, August 2nd at 4pm.

My part of the talk is focused on security and privacy concerns with social networks, fake accounts, using social networks for penetration testing and the proliferation of bots on social networks.  I will also be talking about a new version of Robin Wood’s fantastic “Twitterbot” (we actually have a new name for the tool which will be announced at DefCon).  I’ll be providing a live demo showing the new and improved features of his tool!  Big shoutout to Robin for all the work he did on this tool!

The other speaker is Kevin Johnson who you may know as the project lead for BASE and SamuraiWTF (Web Testing Framework).  Kevin is also a SANS instructor for Security 542 (Web App Penetration Testing and Ethical Hacking).  When he isnt managing projects and teaching he’s most likely abusing “playing with” social networks.  Kevin will be talking about SocialButterfly which is an application that can leverage and exploit various social network API’s.  He will also talk about manipulating social networks (and thier users) with third-party applications.  Remember: please accept any and all “friend requests” from Kevin Johnson! :-)

From our talk abstract:

In Social Zombies: Your Friends want to eat Your Brains, Tom Eston and Kevin Johnson explore the various concerns related to malware delivery through social network sites. Ignoring the FUD and confusion being sowed today, this presentation will examine the risks and then present tools that can be used to exploit these issues.

This presentation begins by discussing how social networks work and the various privacy and security concerns that are caused by the trust mass that is social networks. We use this privacy confusion to exploit members and their companies during our penetration tests.

The presentation then discusses typical botnets and bot programs. Both the delivery of this malware through social networks and the use of these social networks as command and control channels will be examined.

Tom and Kevin next explore the use of browser-based bots and their delivery through custom social network applications and content. This research expands upon previous work by researchers such as Wade Alcorn and GNUCitizen and takes it into new C&C directions.

Finally, the information available through the social network APIs is explored using the bot delivery applications. This allows for complete coverage of the targets and their information.

How did this talk come together?  Kevin and I had some past converations regarding social network bots (mostly from my Notacon 6 talk) and decided that much of our research was similar so it made sense to “combine forces” to work on some of this research together.  Also, by working on bots and socnet bot delivery mechinisms we hope to raise awareness about some of the security and privacy threats that are out there, not just for the users of social networks.  Oh, and we both like Zombies.  See you at DefCon!

Share and Enjoy

FacebookTwitterDeliciousDiggStumbleUponAdd to favoritesEmailRSS

Facebook Hack via FBML Application

I’d previously stated that I was confident I could relaunch my Facebook hack using an FBML application, but that I hadn’t worked out all the details.  Today, I successfully used an XSS hole in an FBML application to access profile information, just as I had done with canvas applications before.  I did so using an XSS vulnerability publicly published almost four months ago.

The particular application used this time always forwards new installs to the same URI, preventing me from using a clickjacking install to fully relaunch the attack page (though an added refresh may do the trick).  But it definitely proves the point that nearly any application with an XSS hole is vulnerable to this type of attack, including FBML applications.

For those who did not get to experience the hack when it was live, I’m including a screenshot of the results page for a fake Facebook profile.

Results page from Facebook attack under a fake profile.

Results page from Facebook attack under a fake profile.

Instapaper Facebook Digg Twitter FriendFeed Delicious Yahoo Bookmarks Google Bookmarks

Understanding Koobface and other "Drive-By Download" type threats

Koobface is a classic “Drive-by Download” type of threat, which can be a difficult thing for anti-virus programs to deal with. The catch is that you’re being fooled into giving a program explicit permission to run. Should an anti-virus program second-guess that decision? Good question.
Read More »

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.

If you’d like to know what a Honey Stick is, and why it’s important to understand what they are telling us, click HERE.

Scott Wright
The Streetwise Security Coach

Join the Streetwise Security Zone at:

Phone: 1-613-693-0997
Twitter ID:

Site Meter

Work from home schemes exploit Twitter users’ impulsive need to get rich quick

It seems like common sense that most people realize “get rich quick” schemes aren’t worth pursuing. However, just like in the height of the Tech Boom of the late ’90’s it seems that people are rationalizing that “things are different” when it comes to Twitter.

Certainly there are some new ways to market products using Twitter, and the fact that Twitter updates can only be 140 characters begs the question “How hard can it be?”

So, it’s not much of a surprise that “get rich quick” scams will find ways to trick people into either giving up personal information, or paying up front for tips on how to make a fortune while lying in bed in your pajamas. But people want to believe it’s still possible to have good fortune, if only they can get the timing right.

Indeed, new trends are emerging so quickly, it might be tempting to feel that you can “get in on the ground floor” of a new business model. But Twitter is a double-edged sword in that it allows attackers to create compelling headlines and hide their malicous intent and websites in shortened links that many people will click on without considering the risks.

Twitter can be used as a way to quickly reach hundred or thousands of followers. But as with any scheme that sounds too good to be true… Twitter-based opportunities deserve just as much scepticism as any other.


I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn’t mean you can’t have an economical way to address human security risks. Please call or email me at the coordinates below…

Scott Wright

The Streetwise Security Coach

Join the Streetwise Security Zone at:

Phone: 1-613-693-0997
Twitter ID:

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.



Site Meter

MoTB #07: Reflected XSS vulns in yfrog

What is yfrog
“yfrog is a service run by ImageShack that lets you share your photos on and videos on Twitter.” (yfrog FAQ page)

Twitter affect
yfrog can be used to send tweets by uploading new photos, or posting comments on existing photos.
yfrog is using OAuth authentication method in order to utilize the Twitter API.

Popularity rate
A competitor to TwitPic in the Twitter photo sharing market. Owned and operated by the popular ImageShack photo sharing service provider – 4 twits

Vulnerability: Reflected Cross-Site Scripting in the Upload and Search pages.
Status: Patched.
Details: The yfrog picture upload page does not encode HTML entities in the “url” variable, which can allow the injection of scripts. Similar vulnerability exists in the “s” variable of the yfrog Search page.
This vulnerability could have allowed an attacker to send tweets on behalf of its victims.

Vendor response rate
The vulnerabilities were fixed 3 hours after they were reported. Excellent – 5 twits.

MoTB #06: Multiple vulnerabilities in TwitPic

What is TwitPic
“TwitPic lets you share photos on Twitter.” (TwitPic home page)

Twitter affect
TwitPic can be used to send tweets by uploading new photos, sending them via email, or posting comments on existing photos.
TwitPic is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
Most popular Twitter photo sharing service. Most visited Twitter 3rd party website, according to Compete – 5 twits

1) Cross-Site Request Forgery in the Email PIN Settings page.
Status: Patched.
Details: This vulnerability was reported by dblackshell. See dblackshell’s advisory for more details:

Few days before “Month of Twitter Bugs” has started, attackers found Britney Spears’ TwitPic email PIN number by using a brute force attack (which was also fixed by TwitPic).
Instead, they could have easily used this CSRF vulnerability in order to tweet the fake death announcement.

2) Cross-Site Request Forgery in the comments form.
Status: Patched
Details: The comments form on each TwitPic picture web page did not use authenticity code in order to validate that the HTTP request POST is coming from the TwitPic web application.
This could have been used by an attacker to send comments on behalf of its victims, which could have also tweet the comments in Twitter.

3) Persistent Cross-Site Scripting in the TwitPic profile page.
Status: Patched.
Details: This vulnerability was first reported to TwitPic on May 18th 2009, and posted on my blog.
TwitPic did not encode HTML entities in the information it imported from the Twitter profile, and displayed in the TwitPic profile.

Vendor response rate
It took TwitPic only an hour to fix the vulnerabilities. Excellent – 5 twits.

In conclusion
TwitPic has a large user base, and I’m happy that they are taking security very seriously. They also take the blame when needed. I’ll keep using TwitPic as my main Twitter photo sharing service.

MoTB #04: CSRF in BigTweet

What is BigTweet
“BigTweet was developed by Scott Carter (@scott_carter) as a way to interact more effectively with various networks from the Web. When you click on the BigTweet bookmarklet, a window appears in the middle of your current web page. Use it to post to Twitter or FriendFeed and then return to what you were doing. It doesn’t get any faster.” (BigTweet home page)

Twitter affect
BigTweet can be used to send tweets from any web page by using a bookmarklet.
BigTweet is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
While Bigtweet is not on any of the top Twitter services lists, it has an easy to integrate bookmarklet interface – 1 twit

Vulnerability: Cross-Site Request Forgery in BigTweet upate.json.
Status: Patched.
Details: The bigtweet update.json web page did not use authenticity code in order to validate that the HTTP post is coming from the bigtweet web application.

Note: While the proof-of-concept in the screenshots used the “xxx” twitter user, the page will actually send a tweet for the currently logged-in user (in the PoC – @avivra). Any registered user could have been used instead of xxx.

Vendor response rate
Vulnerability was fully fixed 22 hours after it has been reported.
Scott Carter, the developer of BigTweet, is also the one who came up with the idea of having a security best practices document for API developers. Alex Payne from Twitter has written such document last week. Excellent – 5 twits.

Password Length and Complexity for Social Media Sites

July 1st was “Twittersec” day as coined by @hevnsnt over at to designate July 1st as change your Twitter password day. Why? Mostly because July is the “month of Twitter bugs” created by a security researcher in which he will announce a bug in a “3rd party Twitter application” everyday for the month of July to raise awareness on security issues with the Twitter API. Technically, this should be “month of 3rd party” Twitter bugs but whatever. Either way it will raise awareness about some of the security issues of Twitter and 3rd party applications.

ANYWAY, back to my point….I sent out some tweets about changing your Twitter password and now being a good time to use a password manager like Keepass to manage multiple, complex passwords for everything…not just social media sites. One problem though is that each site might have different password length and complexity requirements. This becomes an annoying issue when you choose a randomly generated password like I suggest when using a password manager. You will encounter many sites that have specific requirements and others that do not. Obviously, the longer and more complex the password is the harder it is to crack so I suggest going as long as you can. Sad that there are these limitations on certain sites (blame the site developers) but if you set your random password generator to a very large number (I recommend at least 20 with a mix of everything you can throw at it including white spaces if the site will let you), it’s as good as your going to get.

Keep in mind, some applications even supported by the site (like the Facebook app for BlackBerry and iPhone) might not like passwords over a certain length or even certain special characters…you will know once you use these apps. Also, I mention Keepass as a password manager because you can use it on a BlackBerry or Windows Mobile device as well…an iPhone version is being worked on. So here you go…max password lengths for the major social media sites:

None. I tried a 500 character password with everything but white spaces and it worked.

None. I tried a 1000 character password with everything but white spaces and it worked.

10 characters! Wow…really bad. Now I know another reason MySpace sucks.

16 characters! This is interesting. LinkedIn truncates the password to 16 characters! Even if you put in a password larger then 16 characters it will only use the first 16, you can actually see this when entering in a password. No user notification, no info about this in the ‘help’ section. Sneaky and evil.

None. Your account is tied to your Google account so is kind of a pain to change…but I didn’t find any issues with length or complexity.

On another note…I wonder if Twitter and Facebook truncate the passwords at a certain length and don’t tell you? Not sure…but it would be interesting to find out. This is another bad design as a they could easily just hash the entire password (which is a certain manageable length) and the hash is stored in the database not the large character password. Does this mean that sites like MySpace and LinkedIn are storing passwords in clear text? Also, I have run into other sites (non-social network) that actually truncate the password because when you try to login with an overly complex password…you get denied! Then you enter the cycle of doom…resetting your password thinking you fat fingered that password to begin with over and over. :-/

Are social media password limitations working against you?
Finally, just a quick point on this. Social media sites like MySpace and LinkedIn should NEVER have any limitations on password length or complexity. Certain complexity restrictions (like white space or strange characters) I could understand since you would have to use these passwords on mobile devices and other integrated apps. However, there are no technical limitations of just hashing the passwords to a constant length…and we all know storing passwords in a database in clear text is never a good thing.

Shouldn’t these social media sites that you already give your personal information to be trying to protect you the user as best as they can by letting you set a long and complex password? Let’s hope MySpace and LinkedIn get better at this real soon!

1 16 17 18 19 20 22