4 ms·

My previous comment didn't get so much attention, perhaps this will... https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20SRC%3Dhttp%3A%2F%2Fkt-media.k

My previous comment didn't get so much attention, perhaps this will... https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20SRC%3Dhttp%3A%2F%2Fkt-media.knowtechie.netdna-cdn.com%2Fwp-content%2Fuploads%2F2014%2F12%2Fhacker1.jpg%3E%22%3B'%20%3E%20out&region=en-CA&uiLanguage=browser https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20S... Edit: I had an example of displaying the IP address back to the user from my server, but it went over capacity in a few short minutes, so I took it down and removed the link. I am sure everyone gets the point, specially with a lot of the other examples provided by other HN users below. Here is a screen shot for future reference: http://imgur.com/PkAGhqn http://imgur.com/PkAGhqn

eevilspock 11y ago
Red herring. Serious bugs have been found in lots of respect worthy software and service efforts. It just needs to be fixed. You are holding a toddler up to the standards of a pre-teen (which is the highest I'd put Google). The question here is whether this is a respect worthy effort at privacy protection. EDIT: Flaws or holes have been found in Tor. Does that mean we reject the Tor effort outright? If anything, the holes found in Tor are more serious and fundamental, because they raise doubts about Tor's approach and whether their goal can ever be achieved. An HTML injection hole in Hulbee is simply an issue of incomplete execution of their vision, which may or may not be forgivable depending on the technical and non-technical circumstances (which none of us here know yet).
- captaincrunch 11y ago
  I admire their efforts, but serious efforts need to start with the fundamentals.
- pjc50 11y ago
  whether this is a respect worthy effort at privacy protection If they've launched with an HTML injection vulnerability, their security infrastructure is not sufficient to protect your privacy. Game over.
  - karussell 11y ago
    If they don't store your IP (or personalized info) they probably do not need that high security standards ;)
- ctb_mg 11y ago
  I would argue the Tor example is not a valid comparison. Tor is a very complex system. It has a vast attack surface for holes, especially if you ignore boundaries like assuming there is a globally omniscient adversary. Contrastingly, websites sanitizing inputs has been done for quite some time; it is hardly new, difficult, or complex. It's fundamental. I would guess most people's answer is that this is not a sufficient effort to protect privacy or security.
deleted 11y ago
[deleted]
- jshuf7g 11y ago
  You can also run JS on the page. Try searching for: jv98y4yt47tgfuf4<img src=dhdu4ye.jpg onerror="alert('XSS')">
  - deleted 11y ago
    [deleted]
    - jshuf7g 11y ago
      You could log data about the user (example by captaincrunch in their updated comment), directly modify the way the page looks (e.g. a fake virus alert page) or simply redirect the user to any site you want. It's bad on a 'normal' site, but even worse here given their target market.
obblekk 11y ago
nice find, however the perl command is unnecessary. <IMG SRC=http://kt-media.knowtechie.netdna-cdn.com/wp-content/uploads/2014/12/hacker1.jpg> works as well. the server isn't executing perl, it's just not escaping client input allowing you to add html tags to the result page. edit: i should say - it's absurd that anyone can launch a website with this kind of vulnerability in 2015. every html rendering framework i've ever used/read about automatically sanitizes user input when generating the html. the only accidental way i can imagine someone doing this is building html from string concatenations... edit2: for a simple challenge, try to embed other tags. like A or SCRIPT
deleted 11y ago
[deleted]
uniformlyrandom 11y ago
Is is not a bug, it is a feature (image search, that does not work too well). When you place an IMG tag, it tries to find some results by that image (similar to Google's seach by image->URL). Try using an invalid reference or IFRAME SRC. Edit: I stand corrected. They do embed poorly-filtered request text into the results page.
- obblekk 11y ago
  This is false. There's no reason I should be able to embed the following onto someone else's page: https://hulbee.com/?query=%3Ca%20href%3D%22%23%22%20obfuscate%3D%22238942932djwdj928%22%20onClick%3D%22alert('pwnd')%3B%22%3Eclick%20here%20for%20results%3C%2Fa%3E&region=browser&uiLanguage=browser
jpswade 11y ago
XSS injection is possible too: https://hulbee.com/?query=%3CIMG%20SRC%3D..%2FImages%2Flogo-hulbee.png%20onload%3Dalert(%27hello%27)%3E&region=en-CA&uiLanguage=browser https://hulbee.com/?query=%3CIMG%20SRC%3D..%2FImages%2Flogo-... <IMG SRC=../Images/logo-hulbee.png onload=alert('hello')>
UserRights 11y ago
This is not a bug, you are just uninformed: a platform that allows anybody to use anybodys machine for anything is the final business model in web 2.0. Everybody in the startup world is getting crazy about this. BTW google is doing it, Mickysoft and Apple is doing it - only difference is that they try to maintain exclusive customer access to these features, but it does not work out always. hulbee entering the scene as an unrestricted distributed code execution platform freely available for anybody will change everything!
jacquesm 11y ago
So much for your privacy I guess. That most likely isn't the only thing wrong with their infrastructure if they missed that.
eddington 11y ago
They "fixed" it. Well, there's still another. https://hulbee.com/?query=%3C%2Fscript%3E%3Cimg%20src%3Dsdf%20onerror%3Dalert(1)%3E https://hulbee.com/?query=%3C%2Fscript%3E%3Cimg%20src%3Dsdf%... It runs on Chrome and bypasses the filter. Edit: for context, the parent found an XSS issue. It was patched within a few hours. The patch was incomplete, and this one still worked. So, not only do they get it wrong for launch. When presented with an exploit they don't even patch the full vulnerability. I'll trust my data with someone who understands security, thank you very much.

eevilspock 11y ago

Red herring. Serious bugs have been found in lots of respect worthy software and service efforts. It just needs to be fixed. You are holding a toddler up to the standards of a pre-teen (which is the highest I'd put Google). The question here is whether this is a respect worthy effort at privacy protection. EDIT: Flaws or holes have been found in Tor. Does that mean we reject the Tor effort outright? If anything, the holes found in Tor are more serious and fundamental, because they raise doubts about Tor's approach and whether their goal can ever be achieved. An HTML injection hole in Hulbee is simply an issue of incomplete execution of their vision, which may or may not be forgivable depending on the technical and non-technical circumstances (which none of us here know yet).

captaincrunch 11y ago
I admire their efforts, but serious efforts need to start with the fundamentals.
pjc50 11y ago
whether this is a respect worthy effort at privacy protection If they've launched with an HTML injection vulnerability, their security infrastructure is not sufficient to protect your privacy. Game over.
- karussell 11y ago
  If they don't store your IP (or personalized info) they probably do not need that high security standards ;)
ctb_mg 11y ago
I would argue the Tor example is not a valid comparison. Tor is a very complex system. It has a vast attack surface for holes, especially if you ignore boundaries like assuming there is a globally omniscient adversary. Contrastingly, websites sanitizing inputs has been done for quite some time; it is hardly new, difficult, or complex. It's fundamental. I would guess most people's answer is that this is not a sufficient effort to protect privacy or security.

deleted 11y ago

[deleted]

jshuf7g 11y ago
You can also run JS on the page. Try searching for: jv98y4yt47tgfuf4<img src=dhdu4ye.jpg onerror="alert('XSS')">
- deleted 11y ago
  [deleted]
  - jshuf7g 11y ago
    You could log data about the user (example by captaincrunch in their updated comment), directly modify the way the page looks (e.g. a fake virus alert page) or simply redirect the user to any site you want. It's bad on a 'normal' site, but even worse here given their target market.

obblekk 11y ago

nice find, however the perl command is unnecessary. <IMG SRC=http://kt-media.knowtechie.netdna-cdn.com/wp-content/uploads/2014/12/hacker1.jpg> works as well. the server isn't executing perl, it's just not escaping client input allowing you to add html tags to the result page. edit: i should say - it's absurd that anyone can launch a website with this kind of vulnerability in 2015. every html rendering framework i've ever used/read about automatically sanitizes user input when generating the html. the only accidental way i can imagine someone doing this is building html from string concatenations... edit2: for a simple challenge, try to embed other tags. like A or SCRIPT

deleted 11y ago

[deleted]

uniformlyrandom 11y ago

Is is not a bug, it is a feature (image search, that does not work too well). When you place an IMG tag, it tries to find some results by that image (similar to Google's seach by image->URL). Try using an invalid reference or IFRAME SRC. Edit: I stand corrected. They do embed poorly-filtered request text into the results page.

obblekk 11y ago
This is false. There's no reason I should be able to embed the following onto someone else's page: https://hulbee.com/?query=%3Ca%20href%3D%22%23%22%20obfuscate%3D%22238942932djwdj928%22%20onClick%3D%22alert('pwnd')%3B%22%3Eclick%20here%20for%20results%3C%2Fa%3E&region=browser&uiLanguage=browser

jpswade 11y ago

XSS injection is possible too: https://hulbee.com/?query=%3CIMG%20SRC%3D..%2FImages%2Flogo-hulbee.png%20onload%3Dalert(%27hello%27)%3E&region=en-CA&uiLanguage=browser https://hulbee.com/?query=%3CIMG%20SRC%3D..%2FImages%2Flogo-... <IMG SRC=../Images/logo-hulbee.png onload=alert('hello')>

UserRights 11y ago

This is not a bug, you are just uninformed: a platform that allows anybody to use anybodys machine for anything is the final business model in web 2.0. Everybody in the startup world is getting crazy about this. BTW google is doing it, Mickysoft and Apple is doing it - only difference is that they try to maintain exclusive customer access to these features, but it does not work out always. hulbee entering the scene as an unrestricted distributed code execution platform freely available for anybody will change everything!

jacquesm 11y ago

So much for your privacy I guess. That most likely isn't the only thing wrong with their infrastructure if they missed that.

eddington 11y ago

They "fixed" it. Well, there's still another. https://hulbee.com/?query=%3C%2Fscript%3E%3Cimg%20src%3Dsdf%20onerror%3Dalert(1)%3E https://hulbee.com/?query=%3C%2Fscript%3E%3Cimg%20src%3Dsdf%... It runs on Chrome and bypasses the filter. Edit: for context, the parent found an XSS issue. It was patched within a few hours. The patch was incomplete, and this one still worked. So, not only do they get it wrong for launch. When presented with an exploit they don't even patch the full vulnerability. I'll trust my data with someone who understands security, thank you very much.