5 ms·

Maybe I didn't have enough coffee yet today, or maybe I'm just missing something entirely, but.... this whole report talks about how the web API leaks user data

Maybe I didn't have enough coffee yet today, or maybe I'm just missing something entirely, but.... this whole report talks about how the web API leaks user data, right? Yet all I see in their examples are HTTPS requests. Doesn't that require that somebody already infiltrated either a client device (scope limited to single client), or a central server? How did they man-in-the-middle/decrypt this HTTPS traffic? True, if a web cache (not under exclusive control of the company) can be queried for this data by a 3rd party, it sure is a big problem. But that is rather an operational fuck-up more than it is a fundamental design flaw. How did these pen testers get access to server requests, inside the HTTPS traffic with 3fun's servers? I'm curious how they got access to this info. I'm also curious why nobody else appears to be asking that question. Did I read the article too quickly and miss something that explains how they did that?

arethuza 7y ago
I don't know how this was done, but traffic could presumably be intercepted by using a proxy and installing the certificate for the proxy on the device - you have a secure connection from the app to the proxy and a separate secure connection from the proxy to the servers but the proxy gets to see all traffic in the clear.
kjaftaedi 7y ago
They're just querying the API. The data they are examining was meant so the app knows how many people are "in your area" .. but instead of just giving you some vague information, it's giving you the exact coordinates of other users, and identifying info about them.
- rossdavidh 7y ago
  Really, one could argue it's not even "leaking" data about other users, it's just delivering that data to you per your request. "Leak" kind of implies at least disclosing info about other users was not your intention, whereas this seems more like "Delivering".
  - hn_throwaway_99 7y ago
    > "Leak" kind of implies at least disclosing info about other users was not your intention That's the whole point - it's not uncommon for (very) junior programmers to not understand the difference between client and server-side validation. This is absolutely a leak.
jakobegger 7y ago
> How did they man-in-the-middle this HTTPS traffic? The easiest way would be to use a HTTPS debugging proxy like Charles. But really, since the testers control the client device, they can do whatever they want. The problem is that 3fun trusts the client to keep other users data private. This is pretty obviously a bad idea, since attackers can modify the client in pretty much any way they like.
- leetbulb 7y ago
  They are using Burp to proxy the HTTP requests. Assuming there's no proper CA validation on the client side or client certificates, it's quite trivial.
elmo2you 7y ago
Thanks, everyone, for your answers. I made the mistake of assuming that the web API would only give access to data related to a specific client device (thus only "leaking" info about that client). If their web API gives access to info of other clients, that is indeed a serious design fuck-up.

arethuza 7y ago

I don't know how this was done, but traffic could presumably be intercepted by using a proxy and installing the certificate for the proxy on the device - you have a secure connection from the app to the proxy and a separate secure connection from the proxy to the servers but the proxy gets to see all traffic in the clear.

kjaftaedi 7y ago

They're just querying the API. The data they are examining was meant so the app knows how many people are "in your area" .. but instead of just giving you some vague information, it's giving you the exact coordinates of other users, and identifying info about them.

rossdavidh 7y ago
Really, one could argue it's not even "leaking" data about other users, it's just delivering that data to you per your request. "Leak" kind of implies at least disclosing info about other users was not your intention, whereas this seems more like "Delivering".
- hn_throwaway_99 7y ago
  > "Leak" kind of implies at least disclosing info about other users was not your intention That's the whole point - it's not uncommon for (very) junior programmers to not understand the difference between client and server-side validation. This is absolutely a leak.

jakobegger 7y ago

> How did they man-in-the-middle this HTTPS traffic? The easiest way would be to use a HTTPS debugging proxy like Charles. But really, since the testers control the client device, they can do whatever they want. The problem is that 3fun trusts the client to keep other users data private. This is pretty obviously a bad idea, since attackers can modify the client in pretty much any way they like.

leetbulb 7y ago
They are using Burp to proxy the HTTP requests. Assuming there's no proper CA validation on the client side or client certificates, it's quite trivial.

elmo2you 7y ago

Thanks, everyone, for your answers. I made the mistake of assuming that the web API would only give access to data related to a specific client device (thus only "leaking" info about that client). If their web API gives access to info of other clients, that is indeed a serious design fuck-up.