9 ms·
How I "hacked" Dustin Curtis's Posterous.
I logged into my outlook, changed my email address to his email address, and sent the email to post@posterous.com.
Dustin mentioned in his article that he didn't require a password, and I wanted to see if he had used the confirmation skip.
Just wanted to apologise to Dustin about any inconvenience, but I do hope I opened his eyes to security a little!
EDIT: A little bit of backstory.
Dustin seems to think, that I did this because of a comment he made, on how the headers could be forged. I had not read this comment. Infact, I read his article, and using the knowledge that I picked up years ago, that you could change the outgoing email address in Outlook (Although, it was Outlook Express in them days) I changed my email to his email.
I saw his email on his website (hi@dustincurtis.com) and thought, "No, he wouldn't be sending his personal emails from that address, that's silly."
I checked the WHOIS on his domain, and saw another email address there. I changed my email, sent a quick "Apparently..." message, and then changed it back to my original email address. I checked his blog, and it didn't seem to work.
I then went to sign up for my own posterous, to play a bit more, and I saw that you had to authorise your posts. Then I saw how this could be disabled for convenience. A few minutes later and the post showed up.
I am a Web Developer, I have experience with bash scripting, curl, sendmail and everything else you would need to fake headers.
I did not fake headers, I changed one field in Outlook. I didn't do this maliciously, and I just did it to prove a point.
Posterous should not be using email alone to authorise posts, and they should not let you disable submission checking.
- jgrahamc 16y agoI agree with the conclusion. Posterous could fix this problem by implementing something like The Zucchini Method (http://www.jgc.org/antispam/03152005-2150120647b00f4af9d3443f97783bf2.pdf http://www.jgc.org/antispam/03152005-2150120647b00f4af9d3443... [PDF]). Basically, they could accept posts via email as long as the user included some hard to guess word (or other token) in the subject line.
- there 16y agoor do what flickr does and give you a unique email address to send to that only you will know. you can add it to your address book so you won't have to remember it, and it's probably stronger than what most users would choose for a password.
- russell_h 16y agoSuch considerations might be overkill for flickr/posterous but that does leave your "secret" email address in the logs of every smtp relay along the way. Its sort of equivalent to putting a password in a URL.
- mbenjaminsmith 16y agoYeah, we're not talking about credit card info. Why not have post@ plus a secret@ available in your options. The more technically inclined could easily use the second, most likely safe enough, system. I really hope they don't complicate an otherwise zen-like experience.
- piotrSikora 16y agoSecurity shouldn't be optional. And this wouldn't fix the issue at all... I bet that 80%+ of users would leave the default post@ submission address.
- neilc 16y agoSecurity shouldn't be optional. That seems like a very dogmatic attitude. Security almost always comes at some cost (e.g., inconvenience), and sometimes that cost is not worth the benefit.
- piotrSikora 16y agoYes, I agree with you. It pretty much always comes at some cost and "user-friendliness" hurts most of the times. But it is exactly that "easy-to-use" design that leads to security holes like the one presented here. And I stand by what I wrote earlier, if you want to add some security options then they should be enabled by default. Having even the best security system in-place is useless when it's disabled. Isn't it?
- jtheory 16y agoThe cost -- if someone successfully manages to spoof their way into your posterous blog -- isn't very high. You'll probably notice fairly quickly, it's hard for "the bad guy" to use for actual gain, and there's no money involved either way. I use a service called Postful to send snail mail via email, that has security along these lines -- I email them a PDF with a mailing address in the subject line, and they post a letter and charge me a buck. They give security options (in my case, I include a "secret" word in the subject line, and there's a confirmation link that's emailed to me), but if I wanted, I could even let anyway send email to a given postful.com address, and it would mail a letter on my dime with no confirmation. I haven't heard about any abuses.
- lhorie 16y agoPerhaps a compromise would be to give the user the option to send emails to a hard-to-guess email address and then, if the user comes across the situation where he needs to delete a spoofed post, make a note near the deletion link that the option is available This way, grandpa talking about his dog doesn't need to bother learning about security he doesn't really care about and the power user can post securely if it so happens that someone decides to spam his blog
- Vivtek 16y agoI think the key here is that grandpa talking about his dog will find in short order that his Posterous blog is full of Viagra ads. Just because the SEO spammers haven't started using Posterous yet doesn't mean they won't pile on in droves once they realize it's possible.
- d0nk 16y agoOther people replied about a randomized/hard to guess email address. Building on your idea of a "hard to guess word" or token in the subject, posterous could allow a user to upload their public key, and require that their posts be gpg/pgp signed with their key (obviously this would be something that users would have to opt into). The displayed post could simply strip out the signature as it would only be needed for authentication.
- Tichy 16y agoOnly with that kind of thing, or even the Zucchini method mentioned above, they would kind of lose their tag line about the easiest way to update a blog (or whatever it is).
- jey 16y agoThey should just use SPF. This is what SPF is designed for, and it allows them to keep the user experience simple and straightforward. No weird passphrase to enter into the email, no weird random email address to email to, etc.
- ComputerGuru 16y agoSPF only identifies the sending domain, not the sender himself. If your address is gmail and my address is gmail, our mx domain has the same spf record and same IPs. Sure, some mail servers will prevent you from authenticating with one ID and sending as another, but many others will let that slide.
- jey 16y agoYes, but that's a fault of the mailserver on that domain. It shouldn't allow spoofed email to be sent from its own domain.
- benatkin 16y agoSounds like a good partial solution to me. If SPF traces it back to a mail server that doesn't allow spoofed email, it could skip the confirmation step. GMail lets people change the from field, but only to an email address they can show they have access to, by clicking a confirmation link.
- ergo98 16y agoWhich others? Give some examples. Gmail won't. Hotmail won't. Yahoo won't. In fact I can't think of a single authenticating mail service that doesn't also validate authorization (e.g. you can only send as you). Now maybe you're going to point out micro-mail servers, but that's kind of beside the point because very few other people share it with you. e.g. you used gmail as your example, but services like gmail aren't vulnerable to that.
- petercooper 16y agoYeah, no passphrase, just a hard to explain set of weird looking DNS entries to confuse the heck out of non-technical people with. The point of having no passworwd is to make it simpler. You might as well go back to using a password instead of using SPF.
- webwright 16y agoThe subject line is the title of the the post at Posterous... though I suppose the could strip it out... i.e. "subj: Blog Post Title Goes here #sekretpassword". Certainly not ideal. Typos would confuse matters and the idea of secret word authentication is not exactly common/obvious for the masses.
- SkyMarshal 16y agoThat would also require sending #sekretpasword in plaintext, also not ideal.
- deleted 16y ago[deleted]
- jcromartie 16y agoIf Dustin were a major corporation or a politician, you'd be talking to the FBI and facing prosecution right now. Nice hack, BTW.
- robinduckett 16y agoHardly a hack!
- bh42 16y agoThere doesn't have to be Knuth level computering for it to be a fun or easy, or simple, or elegant hack. And sadly the comment about the FBI is completely true. Any script kiddies reading this better keep that in mind.
- rubyrescue 16y agoit's a hack in the Bruce Schneier "easiest way to steal pancakes has nothing to do with where money changes hands" sense... Our goal is to eat, without paying, at the local restaurant. And we've got a lot of options. We can eat and run. We can pay with a fake credit card, a fake check, or counterfiet cash. We can persuade another patron to leave the restraunt without eating and eat his food. We can impersonate (or actually become) a cook, a waiter, a manage, or the restraunt owner (who might actually be someone that few workers have ever met). We could snatch a plate off someone's table before he eats it, or from under the heat lamps before the waiter could get to it. We can wait at the dumpster for the busboy to throw away the leftovers. We can pull the fire alarm and sneak in after everyone evacuates. We can even try to persuade the manager that we're some kind of celebrity who deserves a free breakfast, or maybe we can find a gullible patron and tal her into paying for our food. We could mug someone, nowhere near the restraunt, and buy the pancakes. We could forge a coupon for free pancakes. And there's always the time-honored tradition of pulling a gun and shouting, "Give me all your pancakes".
- jbrennan 16y agoYou've made this celiac crave pancakes again. Bad.
- pavs 16y agoIts cute, but its not a hack.
- robinduckett 16y agoYeah I forgot my sarcasm airquotes.
- some1else 16y agoIt seems like a fault that wouldn't hurt the entire system, but it may cause a dilemma similar to Facebooks design flaw, where disowned groups could be taken under control - http://mashable.com/2009/11/10/facebook-groups-hacked/ http://mashable.com/2009/11/10/facebook-groups-hacked/. As with every such flaw, it's likely to start attracking spammers, and should be dealt with in some way (Facebook seems to have disabled reclaiming ownership of groups without admins?)
- robinduckett 16y agopost+uniqueapikey@posterous.com Would half fix this problem.
- evandavid 16y agoor even post+memorableuniqueword@posterous.com
- coderdude 16y agoWhy on Earth would anyone use the confirmation skip? That's basically security through obscurity. Even less so if the email address you use is known by people.
- masklinn 16y agoConvenience is often on the opposite end of the Security slider. Many people go whole hog on it. Same with privacy, see Facebook.
- qjz 16y agoInteresting point, because it suggests that an email address that was kept private and dedicated to Posterous posting could have prevented this attack. So, is this weak security on the part of Posterous, or excellent social engineering on the part of robinduckett? At the least, It's like he simply asked the target for a password; at the most, it's like he found the spare door key in the fake 7-Up can in the garden shed. Note: Creating a "private" email address is beyond the capabilities of 75% of the people I know, who believe that email addresses are exclusively created and assigned by ISPs or employers. I doubt that Posterous will do anything to alienate this group, who appear to be an important target audience.
- rantfoil 16y agoActually it was a bug, and its now fixed.
- drp 16y agoHey, you left your door unlocked so I painted this sign on it to let everyone know.
- coderdude 16y agoThat's what happens when you don't even have a door lock to begin with, then go tell the whole world about it. (Dustin told the whole world about not having a password. Not this guy.)
- rapind 16y agoAgreed. Dustin should probably do a little more work to secure it, however posting fail... Total jerk move.
- ergo98 16y agoDoes Postereous not support SPF? SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password. Sadly SPF is grossly underused.
- ergo98 16y agoAs an aside, instead of post@, posterous should use a guid for each blog. e.g. B566EA61026F474BA8ADB877FF765087@postereous.com If you're on another device just email whoami@postereous.com and it responds with with your GUID post address. Of course email is hardly confidential, and it would be sent in the clear, but it's a heck of a lot more powerful than simply looking at a from address.
- 16y ago
- frognibble 16y agoHow does Posterous authenticate a message in the absence of DKIM or SPF records in DNS? The domain dustincurtis.com does not have an SPF record and DKIM is not supported by the mail host for dustincurtis.com(Google Apps for your Domain). I assumed that Posterous did something clever using the IP address of the SMTP peer or the headers in the message. Does Posterous fallback to just checking the sender email address?
- robinduckett 16y ago> Does Posterous fallback to just checking the sender email address? Apparently so, I didn't even change my name.
- frognibble 16y agoDo you use Google Apps For Your Domain? If so, that might have foiled any IP address checking because dustincurtis.com is also hosted there. EDIT: You must not be using Google Apps for Your Domain because Google does not allow sender forging.
- rantfoil 16y agoThanks for the bug report. This bug is now fixed.
- notaddicted 16y agoThis is a clear example of "good enough." Low security for low value targets -- if you need more you can get it. Setting a password, remembering a special email address, not posting via blackberry/mobile, all of these add friction. EDIT: Although it is fun to think of solutions ... Posterous could mail you back a link; when you hit the link the post goes live. Then you would clearly need control of the sending address to post. And the link could just go to the new article, which you'll likely want to look at anyway.
- olalonde 16y agoI second. I have some flowers outside my house and they never got stolen. I think a lot of hackers overrate security just like a lot of nurses see diseases everywhere.
- extension 16y agoMeasuring the danger of being impersonated is very difficult. It depends on how creative the attacker is and the social circumstances of the victim. Further, the victim can easily be unaware of the danger until they get bitten once. This is going to be a serious issue for Posterous if they ever go mainstream. Opt-in authentication schemes won't be enough to prevent scores of naive people from being humiliated the first time, particularly teenagers.
- city41 16y ago> and they should not let you disable submission checking I realize the security implications of all of the latest Posterous musings. But the fact is if Posterous didn't allow you to disable this I'd stop using their service. Posterous knows this. My use case for Posterous is my phone. It has a nice 8 megapixel camera, and with literally two clicks I can have a picture sent to my Posterous blog. Is it secure? Not at all. Is it extremely convenient and productive? Absolutely.
- WiseWeasel 16y agoMaybe they could add a link in the confirmation email for 'never ask for confirmation to post from this location', which would whitelist that mailserver for posting without confirmation.
- guinness 16y agoE-mail provides no security. An e-mail can be forged simply by using telnet to connect to and SMP server (usually your ISPs) and typing the appropriate message (see wikipedia SMTP. The easiest fix for this is PGP as mentionned in previous posts. This is, however, a horrible solution since it will alienate many users (think your mother). The simplest solution that will do a good enough job is to send back an e-mail to the user with a 'preview' of his post for him to OK it since receiving e-mails is more secure.
- ergo98 16y agoWhich provides a great way to spam people. The preview idea sucks. SPF solves almost all of the issue. Unique mailing addresses should be available for users who want it (yeah most people can handle an address book). The absence of those is just grossly incompetent.
- icey 16y agoI feel like I'm missing something... Yesterday we were talking about the protections on Posterous and I posted an invitation to try to post to a Posterous I had set up (http://news.ycombinator.com/item?id=1439376 http://news.ycombinator.com/item?id=1439376). I got a bunch of emails from Posterous as a result of people trying to fake post to the account that I'd set up. What's different between the way they did it and the way you did it? I'm assuming they also simply changed their email address in their mail client to try to send to my account.
- noodle 16y ago> What's different between the way they did it and the way you did it? he was successful. seriously, though, the difference probably is that you put more time and effort into creating a posterous that was more secure. something as simple as "create it using a difficult email address" should cover most bases. something that most people likely don't do.
- icey 16y agoI put zero time into it. I created a brand new Posterous account, left everything as the default and posted the email address tied to the account here.
- noodle 16y agohm. well, if i had to venture a guess, i would say that it was because you used gmail exclusively, while mr curtis does not. probably easier to slide by if you're a poster who emails through various different clients over time.
- jaycee 16y agoI believe the default requires authorizing your posts. That may be the issue.
- obvioustroll 16y agoHeh. Back when alternate email protocols were still common, it was my job to help support the "smtp gateway" product for a large corporation. I got to the point where I could forge emails by typing in SMTP by hand. This worked very well the day I played a prank on my boss - the boss had sent out an email forged to appear it came from a co-worker that was supposed to be funny but hurt the co-worker's feelings badly. Co-worker wanted revenge, so I created a "letter of resignation" that appeared to come from the boss and that appeared to have been sent to every member of our company - but was really only sent to the boss himself. Co-worker later told me he saw the boss running from office to office trying to do "damage control" before he realized no one else had actually gotten the email.
- deleted 16y ago[deleted]
- mjijackson 16y agoNice hack. You're going to spawn a whole new generation of hackers that uses Outlook to wreak havoc. ;)
- martian 16y agoDoes Posterous filter SEO spam? Otherwise this loophole seems like a perfect opportunity for SEO spam to start filtering in on lapsed accounts that still have some PageRank...
- rantfoil 16y agoWe do kill it and we're building a comprehensive spam killing system too. SEO spam is not welcome on Posterous in the least.
- notphilatall 16y agoI was thinking about implementing a posterous-like email system for calendaring, and was wondering how they authenticated the emails. I recall them getting "hacked" around launch and there being some TC article about how they responded swiftly by adding new security measures. Just registering the "usual" smtp sender / relay and prompting the user before posting something from a different spot could help. I don't know enough about MX records yet, but matching up the domain and sending IP could be another good measure. How else can this be improved?
- shalmanese 16y agoAll of you proposing obscure emails and other solutions, one of the reasons posterous' founders claim for their success is that they explicitly did NOT do any of those things. In fact, they're pretty clear that if they had done any of those things, posterous would have failed.
- a4agarwal 16y agoHey guys. I'm the cofounder of Posterous. Yes, someone did figure out how to post to Dustin's site today. This security hole is now fixed. We had a specific problem with the way we dealt with SPF records. Dustin didn't set any up, and there was a specific way that Robin Duckett's email server responded that caused us to flag it as a false negative for spoofing. For the vast majority of users who use gmail, hotmail or other services, this was never an issue. Since our launch on day one, we have taken email spoof detection very seriously. It's one of our core differentiators: to be able to securely post to your blog by emailing a single, easy to remember address. We don't want to do secret addresses or secret words. Over the past 2 years, we've developed robust spoof detection ip and spend a ton of time trying to stay a step ahead of hackers. Fortunately, we've only had a few very specific, isolated cases where one of our sites was spoofed and each time we have improved our system. Thanks for bringing this to our attention. We always need to be one step ahead of the hackers/spoofers, and we thank the Hacker News community for keeping us on our toes!
- jseeba 16y agoA quick response from Posterous. I'd expect nothing less. Posterous:email spoof detection PayPal:credit card fraud detection See the section in Founders at Work on the value that better fraud detection created for PayPal.
- deleted 16y ago[deleted]
- coderdude 16y agoOdd, the other Posterous threads are getting buried so quickly. When a new comment is posted in any thread it appears at the top, except for these Posterous threads. Is this damage control on the part of YC? The only other person so far to comment under the co-founder on this thread (at time of writing) is jseeba, who has had very little activity and one of the few comments he's ever made was in a thread called "Ask YC: Your favorite startups" where he said "Posterous. It just works." So jseeba doesn't do much around here in the 2 or so years he's been a member but made time to chime in for Posterous again.
- jheriko 16y agoYou could have told him instead of being a jerk - I know from experience that this doesn't work, say in the work place, where proving your point like this is vital if you want to be heard - but for regular people this is basically an attack. Worst of all you told everyone else how to do it... Warning him would have been nice, this IS, by definition almost, malicious - regardless of how you chose to interpret the word yourself.
- deleted 16y ago[deleted]
- jtth 16y agoPoll: hack Dustin Curtis's things every day? Yay? Nay?
- latj 16y agoWhy we quit posterous: We were using posterous fairly often a while back, until my friend got into an argument with the posterous founder. He (my friend) had a few beers and then wrote a stupid message, basically saying that the posterous idea in general was bad (using different words :> ). Then posterous founder replied saying he was banning my friend. We never found out if he actually followed through- because all of us (~15 guys) stopped using it completely the next day. We, as users, have many options when choosing where to host our data, and we want services that are useful, secure, ethical, and beautiful. http://charisma.posterous.com/ http://charisma.posterous.com/ This one is not ready for us.
- code_duck 16y agoSending email apparently from a particular address, as described, is so simple I can't believe two things: 1, that Posterous was set up to let that happen and 2, that in 2010, the email system is still so dumb that I can send mail with any sender address that to the majority of people would be indistinguishable from mail genuinely from the sending address.