12 ms·

The FCC.gov Website Lets You Upload Malware Using Its Own Public API Key

324 points by knaik94 9y ago

msimpson 9y ago
At first, given the headline, I thought this was some new investigative feature.
phsource 9y ago
After reading the API docs, it appears that the FCC operates a mini-imgur/pastebin/file hosting service to help attach files to FCC filings: https://www.fcc.gov/ecfs/public-api-docs.html#Full-Filing-Step-1---Upload-Files https://www.fcc.gov/ecfs/public-api-docs.html#Full-Filing-St... Unfortunately, these "temporary" file uploads end up accessible from the main FCC domain (i.e. fcc.gov), unlike e.g., Google (e.g., "googleusercontent.com" vs. "google.com"). In Google's case, the separate domain helps distinguish the content as unofficial. It's understandable why it was originally engineered this way, since it's probably easier to create a subdomain under fcc.gov rather than to get an unrelated domain, but that's why we ended up here!
- throwaway2016a 9y ago
  "Easier" is a relative. And in this case relatively small. The server and DNS configuration you need for a subdomain is identical to what you need for separate domain. Possibly slightly more to manage if you are using the "naked" domain because of the DNS issue with not supporting CNAME records on the naked domain. If you already have a wildcard SSL certificate for the subdomain a separate domain might be more work because you need a new cert and you don't if you stick with a subdomain. The most work is actually buying the domain. Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork.
  - mattmanser 9y ago
    More likely that the developer didn't even think about it, I know I probably wouldn't.
    - Filligree 9y ago
      You should! There are security implications galore, mostly due to the same-origin policy. Books can and have been written about web security; if you're writing webapps, you need to read one.
      - mattmanser 9y ago
        I'm not saying you shouldn't think about it, it's just a non-obvious vulnerability.
        Filligree 9y ago
        Most of them are. Thus the book.
        mattmanser 9y ago
        My feeling is that it's like computer security, you can bleat all you like about how the millions of developers have to magically know this stuff, or you can build it in by default. One method works, one doesn't. But keep on telling people to read a book, for all the good it will do.
        Filligree 9y ago
        It's not like I'm in any position to do what you're suggesting. It's a bit late to revamp the entire web "security model" by this point.
  - doingmything 9y ago
    And how many layers of red tape do you think the dev would have to go through to get a new domain?
    - throwaway2016a 9y ago
      On my team as a private company it looks like: Dev: "Can I have a domain?" Me: "Sure" 10 minutes later done In government I imagine you need a procurement order which needs to be approved. And my anecdotal experience has been that the dev teams don't always take high priority in those queues. I'm sure it's not as hard as I made it out to be but it is certainly not as straight forward as many of us are used to.
      - namdnay 9y ago
        It's not really linked to private vs public. It's more of an organisation size question. I can guarantee that if you were working in a megacorp it would be the same issue
        52-6F-62 9y ago
        I work in a megacorp. Can confirm. Have to file tickets, and they have to seek approvals for either delegation of server allotments and subdomains or new dns pointers or worse. I regularly need to host internal applications accessible by other staff and often just do so from my machine during the daytime and send them updated IP addresses/ports where they can access them... boss didn't even think it was possible... Yeah. I imagine the government processes are pretty convoluted.
        paulmd 9y ago
        And this is how you get departments running their own infrastructure lava-layered over the top of the unresponsive corporate IT...
        52-6F-62 9y ago
  - xenophonf 9y ago
    Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork. It's not that bad. It is slightly annoying that the procurement rules don't let sysadmins buy multi-year domain registrations---not even for .gov domains. Ultimately, there's nothing stopping a federal employee or contractor from buying another domain except ignorance of good infosec practices. Even a .gov domain isn't all that expensive---$400/year is a drop in the bucket of federal spending.
    - jimktrains2 9y ago
      Wait, .gov domains cost money? I guess I just thought the us government assigned them as needed to agencies. Never thought about cross agency bills.
      - xenophonf 9y ago
        41 CFR part 102-173, the law that authorizes GSA to run the dot-gov registry, allows them to recover their operational costs from registrants: https://www.gpo.gov/fdsys/pkg/CFR-2010-title41-vol3/xml/CFR-2010-title41-vol3-part102-id2024.xml https://www.gpo.gov/fdsys/pkg/CFR-2010-title41-vol3/xml/CFR-...
        jimktrains2 9y ago
        It completely makes sense, I just never thought about it.
- 27182818284 9y ago
  A lot of public universities had a homegrown dropbox lurking somewhere in their infrastructure. Thankfully they were already abused to the point that schools have been shutting them down over the last 5-10 years. (Usually abuse not in the form of malware, but in the form of file sharing movies, etc)
Fjolsvith 9y ago
...and probably get 10 years in federal prison for doing so.
- necessity 9y ago
  it was just a prank bro!
- koolba 9y ago
  ... per upload.
  - travjones 9y ago
    ... per megabyte.
    - sleepychu 9y ago
      It says here you uploaded something nasty called a "Mega Bite"? Please explain that.
      - toomanybeersies 9y ago
        Given that prosecutors tried to show that Sergey Aleynikov was acting maliciously by using Subversion [0] (obviously it's subversive!), I wouldn't be surprised if they tried that. [0]: https://www.vanityfair.com/news/2013/09/michael-lewis-goldman-sachs-programmer https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...
- elif 9y ago
  hacking is an act of war now. pretty sure due process and prison are on the generous end of the outcome spectrum.
dsfyu404ed 9y ago
The description of the author of the pdf that made the rounds yesterday is exactly what I expected. It's a shame most organizations do not do a good job handling vulnerability reports from outside sources and everyone knows is (so nobody tries to alert the organization). I would be very surprised if he was the first procrastinating college student to figure this out.
- Klathmon 9y ago
  I'll send reports of vulnerabilities to some companies out there, but the US government is one are I would never speak a word about any of this to. If I had discovered this, I'd wipe my trail clean and never speak of it again. The likely hood that I'd end up in federal prison for it is just way too high.
  - ShabbosGoy 9y ago
    I'm not sure why people are saying things like this. Why would you go to Federal Prison for using an intended feature on a government website?
    - Klathmon 9y ago
      Because I don't know how it was intended to be used. Just because you can do something doesn't mean you are legally allowed to. People have been prosecuted for simply opening URLs without any authentication, and I know the specifics of that case were different, but it still terrifies me that I might accidentally trigger a bug in a system that looks "intended" to me, but to them looks like a malicious attack. And once they have decided it's against their intention, i'm in the wrong. There's no way for me to easily or quickly "prove" my intentions were pure or my understanding was incorrect, and even if I could it's still months or years of litigation possibly with me in jail. And all of this goes doubly for trying to be a whitehat and letting the government know about vulnerabilities. Saying "hey I found this vuln in your system" is pretty much a confession that I did break the law and used a computer system illegally.
guptaneil 9y ago
This is a sad but easily fixed vulnerability on the part of the FCC. The bigger issue, in my mind, is the fact that the student (presumably an American citizen) who just uploaded a file via a public API is legitimately scared of aggressive retribution from his government. That should speak volumes of where we've fallen as a country.
- Alex3917 9y ago
  > This is a sad but easily fixed vulnerability on the part of the FCC. By law they need to share what you post publicly, including files. This 'vulnerability' has been around for decades.
  - megamindbrian 9y ago
    Agree. Which is why I have decided to be unhelpful instead of risk spending my life in prison for trying to fix a bug.
  - guptaneil 9y ago
    Hosting files is a feature. The bug is doing so on the same domain as an official government source. The fix is registering a non-gov domain like fccusercontent.com and hosting files from there. (Also they should probably limit the API to only accept pdf's, txt, and other reasonable file types.)
    - evanb 9y ago
      Or something like citizens-uploaded-content.gov
      - equalunique 9y ago
        This is more realistic because I believe the US government is mostly restricted from using the .com TLD. That decision came from: "Digital Government: Building a 21st Century Platform to Better Serve the American People". United States Federal CIO Council. May 23, 2012.
peterwwillis 9y ago
Unrelated: What is with the MAGA types that started them using 'cuck' as a catch-all derogatory term? Do any of them realize it's a common sexual fetish which people knowingly and consensually engage in? It's not actually an insult, it's like saying "person who likes bondage".
- na85 9y ago
  It's doubly interesting because seemingly all these people who pride themselves on not being cuckolds seem to need rescuing by a reality tv star with bad hair and small hands. If that's not the definition of being "cucked" I'm not sure what is.
- Qworg 9y ago
  It is leakage from the weird inverted sexual landscape that MRAs and incel swim in - an internet in meme grown too large to contain. It also serves as a handy handle to insult someone's virility or manliness that fits better in a tweet.
  - Bartweiss 9y ago
    > fits better in a tweet I wonder how much Twitter influences which new slang catches on. 'Bae' is a convenient three letters. For that matter, 'SJW' and 'MRA' are nice and short. You can get each term into a tweet, twice even, without using up much space. Start throwing around 8 or 10 letter terms and no one is going to tweet them enough to quickly force them into culture.
    - Qworg 9y ago
      Interesting point! Given the tools we have now to analyze corpus, I bet you could track the birth of memes - especially with an eye towards the question you posed.
    - zeratax 9y ago
      I shorten lots of terms on irc and elsewhere as well, just because it's faster to type. I doubt this is really a twitter only thing, though of course twitter has a huge influence in spreading these things.
deleted 9y ago
[deleted]
azinman2 9y ago
To me the real shock is someone who can figure this out is against net neutrality! I thought only Comcast etc was against it. https://ecfsapi.fcc.gov/file/7521271363.pdf https://ecfsapi.fcc.gov/file/7521271363.pdf
lsmod 9y ago
It looks like they have fixed it (at least some part of it) "Access Denied. File must be attached to a posted filing to be available."

324 points by knaik94 9y ago

At first, given the headline, I thought this was some new investigative feature.

After reading the API docs, it appears that the FCC operates a mini-imgur/pastebin/file hosting service to help attach files to FCC filings: https://www.fcc.gov/ecfs/public-api-docs.html#Full-Filing-Step-1---Upload-Files https://www.fcc.gov/ecfs/public-api-docs.html#Full-Filing-St... Unfortunately, these "temporary" file uploads end up accessible from the main FCC domain (i.e. fcc.gov), unlike e.g., Google (e.g., "googleusercontent.com" vs. "google.com"). In Google's case, the separate domain helps distinguish the content as unofficial. It's understandable why it was originally engineered this way, since it's probably easier to create a subdomain under fcc.gov rather than to get an unrelated domain, but that's why we ended up here!

throwaway2016a 9y ago
"Easier" is a relative. And in this case relatively small. The server and DNS configuration you need for a subdomain is identical to what you need for separate domain. Possibly slightly more to manage if you are using the "naked" domain because of the DNS issue with not supporting CNAME records on the naked domain. If you already have a wildcard SSL certificate for the subdomain a separate domain might be more work because you need a new cert and you don't if you stick with a subdomain. The most work is actually buying the domain. Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork.
- mattmanser 9y ago
  More likely that the developer didn't even think about it, I know I probably wouldn't.
  - Filligree 9y ago
    You should! There are security implications galore, mostly due to the same-origin policy. Books can and have been written about web security; if you're writing webapps, you need to read one.
    - mattmanser 9y ago
      I'm not saying you shouldn't think about it, it's just a non-obvious vulnerability.
      - Filligree 9y ago
        Most of them are. Thus the book.
        mattmanser 9y ago
        My feeling is that it's like computer security, you can bleat all you like about how the millions of developers have to magically know this stuff, or you can build it in by default. One method works, one doesn't. But keep on telling people to read a book, for all the good it will do.
        Filligree 9y ago
        It's not like I'm in any position to do what you're suggesting. It's a bit late to revamp the entire web "security model" by this point.
- doingmything 9y ago
  And how many layers of red tape do you think the dev would have to go through to get a new domain?
  - throwaway2016a 9y ago
    On my team as a private company it looks like: Dev: "Can I have a domain?" Me: "Sure" 10 minutes later done In government I imagine you need a procurement order which needs to be approved. And my anecdotal experience has been that the dev teams don't always take high priority in those queues. I'm sure it's not as hard as I made it out to be but it is certainly not as straight forward as many of us are used to.
    - namdnay 9y ago
      It's not really linked to private vs public. It's more of an organisation size question. I can guarantee that if you were working in a megacorp it would be the same issue
      - 52-6F-62 9y ago
        I work in a megacorp. Can confirm. Have to file tickets, and they have to seek approvals for either delegation of server allotments and subdomains or new dns pointers or worse. I regularly need to host internal applications accessible by other staff and often just do so from my machine during the daytime and send them updated IP addresses/ports where they can access them... boss didn't even think it was possible... Yeah. I imagine the government processes are pretty convoluted.
        paulmd 9y ago
        And this is how you get departments running their own infrastructure lava-layered over the top of the unresponsive corporate IT...
        52-6F-62 9y ago
- xenophonf 9y ago
  Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork. It's not that bad. It is slightly annoying that the procurement rules don't let sysadmins buy multi-year domain registrations---not even for .gov domains. Ultimately, there's nothing stopping a federal employee or contractor from buying another domain except ignorance of good infosec practices. Even a .gov domain isn't all that expensive---$400/year is a drop in the bucket of federal spending.
  - jimktrains2 9y ago
    Wait, .gov domains cost money? I guess I just thought the us government assigned them as needed to agencies. Never thought about cross agency bills.
    - xenophonf 9y ago
      41 CFR part 102-173, the law that authorizes GSA to run the dot-gov registry, allows them to recover their operational costs from registrants: https://www.gpo.gov/fdsys/pkg/CFR-2010-title41-vol3/xml/CFR-2010-title41-vol3-part102-id2024.xml https://www.gpo.gov/fdsys/pkg/CFR-2010-title41-vol3/xml/CFR-...
      - jimktrains2 9y ago
        It completely makes sense, I just never thought about it.
27182818284 9y ago
A lot of public universities had a homegrown dropbox lurking somewhere in their infrastructure. Thankfully they were already abused to the point that schools have been shutting them down over the last 5-10 years. (Usually abuse not in the form of malware, but in the form of file sharing movies, etc)

Fjolsvith 9y ago

...and probably get 10 years in federal prison for doing so.

necessity 9y ago
it was just a prank bro!
koolba 9y ago
... per upload.
- travjones 9y ago
  ... per megabyte.
  - sleepychu 9y ago
    It says here you uploaded something nasty called a "Mega Bite"? Please explain that.
    - toomanybeersies 9y ago
      Given that prosecutors tried to show that Sergey Aleynikov was acting maliciously by using Subversion [0] (obviously it's subversive!), I wouldn't be surprised if they tried that. [0]: https://www.vanityfair.com/news/2013/09/michael-lewis-goldman-sachs-programmer https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...
elif 9y ago
hacking is an act of war now. pretty sure due process and prison are on the generous end of the outcome spectrum.

dsfyu404ed 9y ago

The description of the author of the pdf that made the rounds yesterday is exactly what I expected. It's a shame most organizations do not do a good job handling vulnerability reports from outside sources and everyone knows is (so nobody tries to alert the organization). I would be very surprised if he was the first procrastinating college student to figure this out.

Klathmon 9y ago
I'll send reports of vulnerabilities to some companies out there, but the US government is one are I would never speak a word about any of this to. If I had discovered this, I'd wipe my trail clean and never speak of it again. The likely hood that I'd end up in federal prison for it is just way too high.
- ShabbosGoy 9y ago
  I'm not sure why people are saying things like this. Why would you go to Federal Prison for using an intended feature on a government website?
  - Klathmon 9y ago
    Because I don't know how it was intended to be used. Just because you can do something doesn't mean you are legally allowed to. People have been prosecuted for simply opening URLs without any authentication, and I know the specifics of that case were different, but it still terrifies me that I might accidentally trigger a bug in a system that looks "intended" to me, but to them looks like a malicious attack. And once they have decided it's against their intention, i'm in the wrong. There's no way for me to easily or quickly "prove" my intentions were pure or my understanding was incorrect, and even if I could it's still months or years of litigation possibly with me in jail. And all of this goes doubly for trying to be a whitehat and letting the government know about vulnerabilities. Saying "hey I found this vuln in your system" is pretty much a confession that I did break the law and used a computer system illegally.

guptaneil 9y ago

This is a sad but easily fixed vulnerability on the part of the FCC. The bigger issue, in my mind, is the fact that the student (presumably an American citizen) who just uploaded a file via a public API is legitimately scared of aggressive retribution from his government. That should speak volumes of where we've fallen as a country.

Alex3917 9y ago
> This is a sad but easily fixed vulnerability on the part of the FCC. By law they need to share what you post publicly, including files. This 'vulnerability' has been around for decades.
- megamindbrian 9y ago
  Agree. Which is why I have decided to be unhelpful instead of risk spending my life in prison for trying to fix a bug.
- guptaneil 9y ago
  Hosting files is a feature. The bug is doing so on the same domain as an official government source. The fix is registering a non-gov domain like fccusercontent.com and hosting files from there. (Also they should probably limit the API to only accept pdf's, txt, and other reasonable file types.)
  - evanb 9y ago
    Or something like citizens-uploaded-content.gov
    - equalunique 9y ago
      This is more realistic because I believe the US government is mostly restricted from using the .com TLD. That decision came from: "Digital Government: Building a 21st Century Platform to Better Serve the American People". United States Federal CIO Council. May 23, 2012.

peterwwillis 9y ago

Unrelated: What is with the MAGA types that started them using 'cuck' as a catch-all derogatory term? Do any of them realize it's a common sexual fetish which people knowingly and consensually engage in? It's not actually an insult, it's like saying "person who likes bondage".

na85 9y ago
It's doubly interesting because seemingly all these people who pride themselves on not being cuckolds seem to need rescuing by a reality tv star with bad hair and small hands. If that's not the definition of being "cucked" I'm not sure what is.
Qworg 9y ago
It is leakage from the weird inverted sexual landscape that MRAs and incel swim in - an internet in meme grown too large to contain. It also serves as a handy handle to insult someone's virility or manliness that fits better in a tweet.
- Bartweiss 9y ago
  > fits better in a tweet I wonder how much Twitter influences which new slang catches on. 'Bae' is a convenient three letters. For that matter, 'SJW' and 'MRA' are nice and short. You can get each term into a tweet, twice even, without using up much space. Start throwing around 8 or 10 letter terms and no one is going to tweet them enough to quickly force them into culture.
  - Qworg 9y ago
    Interesting point! Given the tools we have now to analyze corpus, I bet you could track the birth of memes - especially with an eye towards the question you posed.
  - zeratax 9y ago
    I shorten lots of terms on irc and elsewhere as well, just because it's faster to type. I doubt this is really a twitter only thing, though of course twitter has a huge influence in spreading these things.

deleted 9y ago

[deleted]

azinman2 9y ago

To me the real shock is someone who can figure this out is against net neutrality! I thought only Comcast etc was against it. https://ecfsapi.fcc.gov/file/7521271363.pdf https://ecfsapi.fcc.gov/file/7521271363.pdf

lsmod 9y ago

It looks like they have fixed it (at least some part of it) "Access Denied. File must be attached to a posted filing to be available."