6 ms·
Was this able to be done programmatically? Like POST a set of numbers and get back their location data. Wonder how long this was open for any bad actors to exp
by bhaile 8y ago
Was this able to be done programmatically? Like POST a set of numbers and get back their location data.
Wonder how long this was open for any bad actors to exploit.
- nneonneo 8y agoYes, that's exactly what I ended up doing - I had a little script that took a phone number and spat out a Google Maps page.
- cazum 8y agoWould you mind paste-binning/gist/posting the script? I'd be interested in seeing exactly how easy it was. I was playing around with the site last night but couldn't get anywhere.
- nneonneo 8y agoI've posted a full writeup here: https://www.robertxiao.ca/hacking/locationsmart/ https://www.robertxiao.ca/hacking/locationsmart/
- x0x0 8y agoWas this in any way protected or did you just watch network requests in your browser, see an endpoint, and curl it? I'm not diminishing your discovery, just wondering if it was utterly trivial to use...
- nneonneo 8y agoI modified a request in a fairly predictable way and bypassed the consent stage. See the full writeup here: https://www.robertxiao.ca/hacking/locationsmart/ https://www.robertxiao.ca/hacking/locationsmart/
- chatmasta 8y agoThanks for the write up! All I can say is wow. I was going to poke around that site yesterday after I saw the article, because looking at their website it really looked like there had to be some vulnerabilities. What you tried is exactly the kind of thing I would have looked at first. Yep, there’s no way you’re the first to find this. Honestly I’m at a loss for words how absurd this is. We just need to assume this was actively exploited for who knows how long.
- nneonneo 8y agoI definitely do not assume that I'm the first to find this, only the first to actually get it taken down. Worse, as the try site's been up since at least Jan 2017, that's nearly 18 months of exposure. We won't know what the real exposure level was unless someone asks LocationSmart very persuasively.
- chatmasta 8y agoI highly doubt they even know.
- nneonneo 8y agoIdeally, they have access logs (for the web API, their backend location requests, or both) that could be used to detect patterns of misuse. Unfortunately, since their API is exclusively POST, the web server access logs will be less useful, but they could be used to detect e.g. direct API queries that skip the consent request.
- bigiain 8y agoAnybody know a EU citizen in the US who'd be prepared to request how often their data's been accessed using the GDPR regs?
- chatmasta 8y agoDo you think your graduate degree was necessary to find this bug, or could any idiot with devtools open find it just by trying to automate the site? Your descriptions thus far are pretty vague but man... it sounds like there is a VERY high likelihood that this was being exploited by malicious actors on an ongoing basis.
- nneonneo 8y agohttps://www.robertxiao.ca/hacking/locationsmart/ https://www.robertxiao.ca/hacking/locationsmart/ provides the technical details. In short: much more likely the latter than the former. And this /try/ page has been up at least since Jan 2017 (~18 months).
- chatmasta 8y agoFYI to anyone downvoting this / the OP: I didn’t mean this to be offensive or crass. I was asking because generally security exploits are ranked by (a) severity and (b) triviality. That is, a severe bug that is extremely difficult to exploit is not as alarming as a severe bug that is trivial to exploit. When laypeople read that a CMU researcher discovered a bug, they might assume it is not trivial. So in that sense mentioning the PhD almost does a disservice to expressing the triviality of the bug. When a high school kid in Hungary discovered he could purchase train tickets for any price by changing it client side, non-technical people could understand it was a trivial bug. When a CMU researcher discovers a bug, they likely assume the opposite.