9 ms·

Posting under an alternative account for obvious reasons. Bad API's used in IoT are a huge vector for attack and too few companies in the mobile first world ha

by klik1 8y ago

Posting under an alternative account for obvious reasons. Bad API's used in IoT are a huge vector for attack and too few companies in the mobile first world have a bug bounty program. I found a similar problem with an API for an app that comes default installed on most android phones I've purchased (think smart phone as a TV remote). I reported it and got no response. Their homepage claims the app is being used for 10's of millions of smart devices like A/C, TV's, Fridges, Microwaves, etc. The vulnerability allowed full account access.

djsumdog 8y ago
If you've made every attempt at responsible disclosure and have gotten no response, it's probably more irresponsible to not do a full post on it. Then again, that of course gets into murky water and it's best to at least try to get legal council or work with a responsible disclosure website. IANAL.
- klik1 8y ago
  the gist of the vulnerability was an expectation that nobody would ever find their origins if they had some crazy hostname: "asuhdfo8a7ys8dfas.website.com" type of setup. In front of this origin they had a server that did auth and auth only. If your auth worked at the edge, the request was sent to origin. The problem is I found a specific input that caused an error dumping a stack trace that contained the origin hostname. I took the original request and replayed it directly at the origin. To my surprise the response was the same as going through the auth server. Then I changed the user id some integer that wasn't mine and got information back. Then I quit playing with it and sent an email. This leaves me in a weird spot because I was fuzzing them looking for details when I was fully aware they did not have a bug bounty program. Why did I do this? Because I was using the app myself, I'm a security guy, and had read about a cool exploit with the uber app. It only took about 5 minutes of setting up burp proxy for my phone with ssl and 5 more minutes of auditing to find an input that dumped the stack trace.
- hinkley 8y ago
  Says the guy giving away the ending of The Expanse in a science thread.

by klik1 8y ago

djsumdog 8y ago

If you've made every attempt at responsible disclosure and have gotten no response, it's probably more irresponsible to not do a full post on it. Then again, that of course gets into murky water and it's best to at least try to get legal council or work with a responsible disclosure website. IANAL.

klik1 8y ago
the gist of the vulnerability was an expectation that nobody would ever find their origins if they had some crazy hostname: "asuhdfo8a7ys8dfas.website.com" type of setup. In front of this origin they had a server that did auth and auth only. If your auth worked at the edge, the request was sent to origin. The problem is I found a specific input that caused an error dumping a stack trace that contained the origin hostname. I took the original request and replayed it directly at the origin. To my surprise the response was the same as going through the auth server. Then I changed the user id some integer that wasn't mine and got information back. Then I quit playing with it and sent an email. This leaves me in a weird spot because I was fuzzing them looking for details when I was fully aware they did not have a bug bounty program. Why did I do this? Because I was using the app myself, I'm a security guy, and had read about a cool exploit with the uber app. It only took about 5 minutes of setting up burp proxy for my phone with ssl and 5 more minutes of auditing to find an input that dumped the stack trace.
hinkley 8y ago
Says the guy giving away the ending of The Expanse in a science thread.