3 ms·
After reading this I have no idea how he actually discovered the vulnerability, aside from a handwavy statement about messing with form input. Most of the writ
by stanleydrew 16y ago
After reading this I have no idea how he actually discovered the vulnerability, aside from a handwavy statement about messing with form input.
Most of the writeup is just a narrative about what he saw and who he talked to afterwards. I'm a little disappointed. I was hoping for more technical detail.
- tptacek 16y agoPresumably, he submitted a ticket, went to the ticket status page, saw a list of tickets each with a link like "http://support.twitter.com/tickets/1532547 http://support.twitter.com/tickets/1532547, and changed the ticket number in the URL. It's possible that it was slightly more tricky than that (it may be that there's a sub-URL that doesn't enforce access control, and that the root URL always did), but from the writeup that appears to be the whole issue. In standard Rails, which the Twitter support ticket site may very well be, this is a one line fix; call User.tickets.find_by_id instead of Ticket.find_by_id.
- stanleydrew 16y agoYeah, I didn't expect it to be thrilling. But some detail would have been good. As it is I'm not really sure what the point of the post was, except to say "Hey, I found something wrong with Twitter and then tweeted with some famous people and then once I found the right email address I told them and they fixed it. Oh and did I mention that it was really important because it affected 1.5 million users?" It would have been more useful if the author included some details and possibly speculation (as you have provided) as to what was going on in Twitter's ticketing setup so that we could all learn from it.