6 ms·

This is a sad but easily fixed vulnerability on the part of the FCC. The bigger issue, in my mind, is the fact that the student (presumably an American citizen)

This is a sad but easily fixed vulnerability on the part of the FCC. The bigger issue, in my mind, is the fact that the student (presumably an American citizen) who just uploaded a file via a public API is legitimately scared of aggressive retribution from his government. That should speak volumes of where we've fallen as a country.

Alex3917 9y ago
> This is a sad but easily fixed vulnerability on the part of the FCC. By law they need to share what you post publicly, including files. This 'vulnerability' has been around for decades.
- megamindbrian 9y ago
  Agree. Which is why I have decided to be unhelpful instead of risk spending my life in prison for trying to fix a bug.
- guptaneil 9y ago
  Hosting files is a feature. The bug is doing so on the same domain as an official government source. The fix is registering a non-gov domain like fccusercontent.com and hosting files from there. (Also they should probably limit the API to only accept pdf's, txt, and other reasonable file types.)
  - evanb 9y ago
    Or something like citizens-uploaded-content.gov
    - equalunique 9y ago
      This is more realistic because I believe the US government is mostly restricted from using the .com TLD. That decision came from: "Digital Government: Building a 21st Century Platform to Better Serve the American People". United States Federal CIO Council. May 23, 2012.
      - gertef 9y ago
        The Federal goverment can authorize a contractor to host authorized content: annualcreditreport.com This is a bad idea, though, as it makes it easy and legal for non-authorized entities to impersonate the authorized ones: freecreditreport.com
  - SEJeff 9y ago
    This is what github did with gist and github pages, for similar issues.
  - Alex3917 9y ago
    It seems more appropriate just to add a ~ to the url, indicating that it's a user-uploaded file from an otherwise trusted domain. Browsers can then warn users about that however they want.
    - inetknght 9y ago
      Is that an actual standard or... just common practice?
      - Alex3917 9y ago
        It's a unix standard, or at least more than just a design pattern. You know how in any unix shell, typing cd ~ takes you to your home directory? This is actually a shortcut for typing cd ~yourusername. So having xyz.tld/~username/... in a url path means that the file is hosted in userland, since ~username is the first part of the filepath hosted behind that URL. Websites have been using this pattern for 25+ years, so it's pretty universal by now.
        gertef 9y ago
        It's not a security standard.
        nucleardog 9y ago
        It's not even a standard. At best you could call it a convention. And a much more narrowly defined one than you seem to think. The `~` or `~username` is expanded by your shell (but not necessarily all shells) and has nothing to do with the operating system. If you pass a filename like `~myusername/test.txt` to any unix's open() syscall, it's going to either fail or open a file in a directory literally called `~myusername`. This means anywhere you're passing a filename into a program that isn't your shell does not generally support that syntax. A narrowly defined, poorly recognized convention is not a great thing to rely on for security purposes.
        Alex3917 9y ago
        Fair enough. What's the process for submitting it as a proposed standard? I'll write it up.
  - 0x4a42 9y ago
    How PDF is a reasonable file type?
- Bhilai 9y ago
  File types should be restricted, there is no need to allow exes to be uploaded.
- athenot 9y ago
  On the flip side, using a gov website to host malware probably has a multiplier effect on charges brought against someone if they get caught.
throw-away-521 9y ago
He published a document[1] on their website with the letter head of the FCC, signed as the FCC. He was trying to impersonate the FCC. There were plenty of other things he could have posted to show off the vulnerability, without the worry of legal trouble. [1]: https://ecfsapi.fcc.gov/file/DOC-578d579d1f000000-A.pdf https://ecfsapi.fcc.gov/file/DOC-578d579d1f000000-A.pdf
- unit91 9y ago
  > He was trying to impersonate the FCC. Was he? This was obviously satirical. Impersonation involves a genuine attempt at deception, not merely having a few trappings of something official. Otherwise, what's the difference between this and somebody dressing-up as a cop for Halloween?
  - throw-away-521 9y ago
    It isn't similar to dressing up a cop. It would be similar to dressing up as one, going to the police station, and telling people that they were a cop. Then trying to explain that it was only a joke and they didn't think people would believe them.
TheAceOfHearts 9y ago
Does it really? I'm genuinely curious during what time period you think our government would've reacted differently. This got me thinking, how would people expect different countries to react to something like this? By making that tweet he's impersonating a government agency and passing it off as an official document. If he hadn't posted that tweet I'm sure he wouldn't have anything to fear. EDIT: I looked up the relevant law: False Impersonation of Federal Officer or Employee [0]. It doesn't seem he got anything of value, so it's unlikely he could be charged. Although I'd be surprised if he didn't at least receive a stern conversation from a government official. [0] http://www3.ce9.uscourts.gov/jury-instructions/node/508 http://www3.ce9.uscourts.gov/jury-instructions/node/508
- icebraining 9y ago
  Is creating a document with an official letterhead but no signature an "impersonation of Federal Officer or Employee"? Paraphrasing Sir Humphrey, that seems to cause epistemological problems of sufficient magnitude as to lay upon the logical and semantic resources of the English language a heavier burden than they can reasonably be expected to bear.
  - ImSkeptical 9y ago
    I think it depends what you're doing with it. For example, if I use my document with official letterhead to send my neighbor a fine that he should pay by mail in cash (that I can then intercept from his mailbox) - that's probably criminal. On the other hand, if I were to use my forged letterhead to write "Don't just trust anything written on a document like this, it's easy to forge!" I hope that wouldn't be. The original incident in the article seems more like the latter to me. If I were on the jury, I certainly wouldn't convict.
    - icebraining 9y ago
      Your example still seem like it wouldn't be impersonation, even if it's fraud.
  - mattyw 9y ago
andai 9y ago
I'd argue along the same lines as a dead comment here: the student's mistake (well, beyond not contacting them to report the issue) was using the FCC's official letterhead to create an embarrassing document and uploading it to their official website and posting it on social media. That's pretty much a "fuck you" and not a great way to start a conversation.
adventured 9y ago
> That should speak volumes of where we've fallen as a country. Yeah, it's obviously substantially below FDR interning 100,000 Japanese people [1] based on their ethnicity. Or spraying black neighborhoods with toxic chemicals to test on them in the 1950s. [2] Or J Edgar Hoover's decades-long parade of power abuses and rights violations of the American People. Or Lyndon Johnson inserting us - hundreds of thousands of drafted young men - into a civil war in Vietnam, in which we helped to directly kill vast numbers of people with no clear plan or explanation for why we were there. Or the testing of hundreds of nuclear weapons on US soil, with little concern for how it would harm citizens. Or Sherman burning down Atlanta. Or Nixon's parade of abuses. Or the CIA's countless, terrifying programs in the 1970s. Or how the FBI tried to get MLK to kill himself. Or prohibition and the terrible results that imposed upon the people (eg rampant organized crime). Or the 50 year war on drugs and the horrific toll that has taken on the people. We used to treat our people with the utmost dignity and respect. [1] https://en.wikipedia.org/wiki/Internment_of_Japanese_Americans https://en.wikipedia.org/wiki/Internment_of_Japanese_America... [2] http://www.businessinsider.com/army-sprayed-st-louis-with-toxic-dust-2012-10 http://www.businessinsider.com/army-sprayed-st-louis-with-to...

Alex3917 9y ago

> This is a sad but easily fixed vulnerability on the part of the FCC. By law they need to share what you post publicly, including files. This 'vulnerability' has been around for decades.

megamindbrian 9y ago
Agree. Which is why I have decided to be unhelpful instead of risk spending my life in prison for trying to fix a bug.
guptaneil 9y ago
Hosting files is a feature. The bug is doing so on the same domain as an official government source. The fix is registering a non-gov domain like fccusercontent.com and hosting files from there. (Also they should probably limit the API to only accept pdf's, txt, and other reasonable file types.)
- evanb 9y ago
  Or something like citizens-uploaded-content.gov
  - equalunique 9y ago
    This is more realistic because I believe the US government is mostly restricted from using the .com TLD. That decision came from: "Digital Government: Building a 21st Century Platform to Better Serve the American People". United States Federal CIO Council. May 23, 2012.
    - gertef 9y ago
      The Federal goverment can authorize a contractor to host authorized content: annualcreditreport.com This is a bad idea, though, as it makes it easy and legal for non-authorized entities to impersonate the authorized ones: freecreditreport.com
- SEJeff 9y ago
  This is what github did with gist and github pages, for similar issues.
- Alex3917 9y ago
  It seems more appropriate just to add a ~ to the url, indicating that it's a user-uploaded file from an otherwise trusted domain. Browsers can then warn users about that however they want.
  - inetknght 9y ago
    Is that an actual standard or... just common practice?
    - Alex3917 9y ago
      It's a unix standard, or at least more than just a design pattern. You know how in any unix shell, typing cd ~ takes you to your home directory? This is actually a shortcut for typing cd ~yourusername. So having xyz.tld/~username/... in a url path means that the file is hosted in userland, since ~username is the first part of the filepath hosted behind that URL. Websites have been using this pattern for 25+ years, so it's pretty universal by now.
      - gertef 9y ago
        It's not a security standard.
      - nucleardog 9y ago
        It's not even a standard. At best you could call it a convention. And a much more narrowly defined one than you seem to think. The `~` or `~username` is expanded by your shell (but not necessarily all shells) and has nothing to do with the operating system. If you pass a filename like `~myusername/test.txt` to any unix's open() syscall, it's going to either fail or open a file in a directory literally called `~myusername`. This means anywhere you're passing a filename into a program that isn't your shell does not generally support that syntax. A narrowly defined, poorly recognized convention is not a great thing to rely on for security purposes.
        Alex3917 9y ago
        Fair enough. What's the process for submitting it as a proposed standard? I'll write it up.
- 0x4a42 9y ago
  How PDF is a reasonable file type?
Bhilai 9y ago
File types should be restricted, there is no need to allow exes to be uploaded.
athenot 9y ago
On the flip side, using a gov website to host malware probably has a multiplier effect on charges brought against someone if they get caught.

throw-away-521 9y ago

He published a document[1] on their website with the letter head of the FCC, signed as the FCC. He was trying to impersonate the FCC. There were plenty of other things he could have posted to show off the vulnerability, without the worry of legal trouble. [1]: https://ecfsapi.fcc.gov/file/DOC-578d579d1f000000-A.pdf https://ecfsapi.fcc.gov/file/DOC-578d579d1f000000-A.pdf

unit91 9y ago
> He was trying to impersonate the FCC. Was he? This was obviously satirical. Impersonation involves a genuine attempt at deception, not merely having a few trappings of something official. Otherwise, what's the difference between this and somebody dressing-up as a cop for Halloween?
- throw-away-521 9y ago
  It isn't similar to dressing up a cop. It would be similar to dressing up as one, going to the police station, and telling people that they were a cop. Then trying to explain that it was only a joke and they didn't think people would believe them.

TheAceOfHearts 9y ago

Does it really? I'm genuinely curious during what time period you think our government would've reacted differently. This got me thinking, how would people expect different countries to react to something like this? By making that tweet he's impersonating a government agency and passing it off as an official document. If he hadn't posted that tweet I'm sure he wouldn't have anything to fear. EDIT: I looked up the relevant law: False Impersonation of Federal Officer or Employee [0]. It doesn't seem he got anything of value, so it's unlikely he could be charged. Although I'd be surprised if he didn't at least receive a stern conversation from a government official. [0] http://www3.ce9.uscourts.gov/jury-instructions/node/508 http://www3.ce9.uscourts.gov/jury-instructions/node/508

icebraining 9y ago
Is creating a document with an official letterhead but no signature an "impersonation of Federal Officer or Employee"? Paraphrasing Sir Humphrey, that seems to cause epistemological problems of sufficient magnitude as to lay upon the logical and semantic resources of the English language a heavier burden than they can reasonably be expected to bear.
- ImSkeptical 9y ago
  I think it depends what you're doing with it. For example, if I use my document with official letterhead to send my neighbor a fine that he should pay by mail in cash (that I can then intercept from his mailbox) - that's probably criminal. On the other hand, if I were to use my forged letterhead to write "Don't just trust anything written on a document like this, it's easy to forge!" I hope that wouldn't be. The original incident in the article seems more like the latter to me. If I were on the jury, I certainly wouldn't convict.
  - icebraining 9y ago
    Your example still seem like it wouldn't be impersonation, even if it's fraud.
- mattyw 9y ago

andai 9y ago

I'd argue along the same lines as a dead comment here: the student's mistake (well, beyond not contacting them to report the issue) was using the FCC's official letterhead to create an embarrassing document and uploading it to their official website and posting it on social media. That's pretty much a "fuck you" and not a great way to start a conversation.

adventured 9y ago

> That should speak volumes of where we've fallen as a country. Yeah, it's obviously substantially below FDR interning 100,000 Japanese people [1] based on their ethnicity. Or spraying black neighborhoods with toxic chemicals to test on them in the 1950s. [2] Or J Edgar Hoover's decades-long parade of power abuses and rights violations of the American People. Or Lyndon Johnson inserting us - hundreds of thousands of drafted young men - into a civil war in Vietnam, in which we helped to directly kill vast numbers of people with no clear plan or explanation for why we were there. Or the testing of hundreds of nuclear weapons on US soil, with little concern for how it would harm citizens. Or Sherman burning down Atlanta. Or Nixon's parade of abuses. Or the CIA's countless, terrifying programs in the 1970s. Or how the FBI tried to get MLK to kill himself. Or prohibition and the terrible results that imposed upon the people (eg rampant organized crime). Or the 50 year war on drugs and the horrific toll that has taken on the people. We used to treat our people with the utmost dignity and respect. [1] https://en.wikipedia.org/wiki/Internment_of_Japanese_Americans https://en.wikipedia.org/wiki/Internment_of_Japanese_America... [2] http://www.businessinsider.com/army-sprayed-st-louis-with-toxic-dust-2012-10 http://www.businessinsider.com/army-sprayed-st-louis-with-to...