15 ms·
Stealing Your Private YouTube Videos, One Frame at a Time
- JeremyBanks 6y agonice find
- Mindwipe 6y agoInteresting. There are a lot of product announcements that are handled by uploading private videos that are made public at a given time, so there'd be quite a lot of attacker interest in this exploit if it hadn't been fixed. Worth the bounty.
- archi42 6y agoNot sure why this ~is~ was downvoted. IMHO that's a quite realistic scenario on how IDs of private videos might "leak".
- Mindwipe 6y agoYeah, I know. I think HN is getting brigaded pretty badly for anyone who's said that Parler's security was garbage, so maybe that?
- derangedHorse 6y agoMaybe people disagree with the last statement of it being worth the bounty (as many including myself think it’s worth way more)
- Mindwipe 6y agoOh, I would certainly not disagree with that, I meant worth at least the bounty.
- BHSPitMonkey 6y agoIt isn't a very noteworthy scenario, because it requires the person who _has_ been given access to a private video/ID to share it with someone who shouldn't have access. In that already-rare scenario, the person with access can simply download or record the video anyway, thereby leaking it (with audio and high-resolution to boot). And that's with everything working as intended. Chained with another exploit to actually be able to discover someone's private video IDs, it would have been worth a much higher bounty.
- Mindwipe 6y agoIt is very common for people to discover private video IDs in product pages by combing through the HTML for announcement pages, product listings inadvertently put up early by retailers (and some retailer, somewhere, will always screw it up) etc. I honestly can't think of a week that goes by without the discovery of a private video ID in the videogame space tbh for some unannounced title or feature.
- Tinyyy 6y agoNice! I think you meant if the video is /30/ FPS, then the time between each frame is 33ms.
- jarym 6y agoNice work to the researcher and also gotta give YT credit for nailing down a lot of entry points in the first place and responding responsibly to this disclosure.
- dkdk8283 6y agoHunting vulns like this is super tedious - glad that there are bounty programs and hunters with the time to find and responsibly disclose bugs.
- xwdv 6y agoNow if only they could get decent payouts.
- Deukhoofd 6y agoWell, this author states he got a $5000 payout, I'd consider that pretty decent.
- sneak 6y agoIt's not when you consider it in context of the unpaid work one has to do to find payout bugs like this. For context, this is approximately what Google has to pay for an entry level engineer employee to work for ~40 hours. Finding a bug of this severity level in a publicly accessible service with a bug bounty program every 40 hours of work is... a stretch of the imagination for an entry level person.
- rewq4321 6y agoSecurity researchers can easily get $500 per hour on consult. The author should "charge" based on a percentage of the value that this bug fix gives to google. I'd argue that for such a huge platform this bug is worth tens if not hundreds of thousands. Certainly would cause way more reputational damage than that of there was a large-scale data leak based on this.
- hinkley 6y agoMore importantly, the value of zero day exploits on the black market can run into the hundreds of thousands, we are told. As the music industry learned the hard way, if you make it too hard to be a good guy, everyone will become a bad guy.
- jonplackett 6y agoNice work. Are there really still no updates on why this was the case? Seems like this all happened a year ago.
- EE84M3i 6y agoGoogle pays $5000 for IDORs? That's really good.
- wegs 6y agoUmmm... no. If this is like a week's worth of work, you're looking at $250k annualized income, $125k after overhead. In practice, you're not finding a bug like this every week. The bug bounty programs were originally intended to give a white hat market alternative to the black hat and gray hat markets. They don't do that. If I find a bug, and I want profit, I'm much better off selling to my government than to Google. One can only imagine the number of exploits the US, China, Russia, North Korea, etc. have in their cyber-warfare vaults. Exploits compound. Often, two minor exploits make a major exploit.
- EE84M3i 6y agoAll I meant was that this is significantly better than other programs. I've seen similar bugs pay out in the hundreds.
- bitwize 6y agoIf everything were priced at its actual value, SV would collapse like a house of cards. The whole industry is based on obtaining for bargain basement prices engineering or research work which coukd be worth billions.
- gitanovic 6y agoThat's exactly why there is a black market for 0-day exploits... because they are worth more than what are paid by the companies owning those liabilities
- seastonATccs 6y agoI got a 5k payout from google for serious OAuth bypass bug. I'm not a security researcher so I wouldn't have any idea or really desire to sell something like this to a Government. But I'd have to agree that if I had publicly revealed the bug Goog would have lost magnitudes of business or possible fines from governments far above and beyond 5k.
- londons_explore 6y agoThe researcher suggests that finding private youtube video id's itself would be a bug... Youtube video ID's were generated by taking an internal integer, and encrypting it with a fixed key. That key has been leaked in the early days of youtube (pre google buying it). That means there are a bunch of early video id's that are predictable. That makes this bug much worse.
- swyx 6y agoi dont see how that would be a "bug" per se - the concept of "private" is set based on the account ownership, not the id itself. you could set a public video to private, or vice versa. whatever the ID, google still has to check against your authz before showing the video. this seems better than relying on security by obscurity.
- Dylan16807 6y ago> the concept of "private" is set based on the account ownership, not the id itself I feel like this article should demonstrate why private should be both things whenever possible. > you could set a public video to private, or vice versa You could, but if you don't leak the ID all over then it should provide an extra step of security. > security by obscurity Hiding an ID like this isn't all that different from hiding a key.
- bredren 6y agoAlso, notable, already linked, YouTube videos are made private all of the time. So this big created a method for continued albeit silent and low res access to private but known videos of note. I think videos after being made private can be edited by the owner. So it would be possible for new “private” data from a known video id to leak this way.
- loydb 6y agoReally nice work! And good response from Google.
- swyx 6y agothis was all very easy to follow and made sense. kudos to the author. for the experienced hackers in the room - what would your reasonable next step be if you wanted to get audio or higher resolution video? just wondering because i often see these researchers not stop after finding the first exploit, and its often the subsequent exploits built up from their knowledge of the system that uncover the really damning security holes
- markjgx 6y agoIf you don't want to download every single frame you could feed these into DAIN (Depth-Aware Video Frame Interpolation) https://github.com/baowenbo/DAIN https://github.com/baowenbo/DAIN
- sam1r 6y agoTimeline says on Jan 17, $5000 issued. Let’s hope op gets it!
- encom 6y agoHe should have, it's been almost a year.
- drcoopster 6y agoHe neglected to mention his time machine.
- sam1r 6y agoGood catch.
- gymalpha18 6y agoWhat tool did he use to view proxy logs?
- jabroni_salad 6y agoTelerik Fiddler is what I typically use.
- stragies 6y agoI thought, that there was an unwritten rule on HN, that you don't mention closed-source, subscription-based software behind an email registration without making those down-sides abundantly clear? Don't enable the next Solarwind.
- ju_sh 6y agoFantastic work and great write-up!
- jjice 6y agoA bit off topic, but what does YouTube gain from offering private and unlisted videos? It's convenient hosting, but it seems like they don't get nearly the same benefit as from a public video.
- baud147258 6y agoFor unlisted videos, I'd say it's an useful feature, for when you want to easily share a video to some people, but not the whole world (especially if they already have a YT account). And for YT, it would allow for creators to continue to use YT instead of having to go looking for another solution.
- CobsterLock 6y agoMy gut guess is training data for their ML. Do ads run on unlisted/private videos?
- jjcon 6y agoThey have orders of magnitude more video data than they can use for training that is already public
- Causality1 6y agoTo keep people from going to other video hosts who offer those features. It's a value-add for the platform. It lets you upload videos well in advance of publishing them, or temporarily remove them. You also have to consider the fact viewer numbers are so low for private and unlisted videos they may as well be free to host, aside from the drive space they occupy.
- rwmj 6y agoNot sure what Youtube gains except keeping people in the ecosystem, but Youtubers sometimes offer early access to their Patreon subscribers, which is done by uploading a private video and then changing the video to public after the exclusive period has finished.
- 6y ago
- SoSoRoCoCo 6y agoThis hack is great because the dev didn't have to read assembly code or parse WireShark logs or deploy any kind of cracking software. They simply observed the ecosystem carefully and deduced a failure mode through some serious mental BFS.
- phkahler 6y ago>> This hack is great because the dev didn't have to read assembly code or parse WireShark logs or deploy any kind of cracking software. Monitoring network traffic (http requests) and logs is similar to any other logged data or reading disassembled code. Patching in a different video ID is sort of like patching ASM to implement some hack. The automation created at the end to extract and assemble the video was basically creation of cracking software for this particular exploit. What one person calls arcane knowledge is another's everyday tools. This is a case where I see obscure technical stuff, but web devs see regular stuff ;-)
- SoSoRoCoCo 6y ago> What one person calls arcane knowledge is another's everyday tools. Point taken. If this had been something about Android I'd be staring at my screen drooling like a dog looking at a TV.
- ehsankia 6y agoIt's also worth that the author doesn't go too much into detail of the how, and focuses more on the what > With my first account, I started using YouTube, trying every feature, pressing every button I could find, and whenever I saw an HTTP request with a video ID in it, I changed it to the target Private video Was this done with some tooling or scripts, or purely by eyeing devtools? I could see that step for example being very similar to "parse WireShark logs", for example. I agree that the level of detail included makes it fairly readable without being to scary to non-experts.
- bostik 6y ago
- rossmohax 6y agoClassic "confused deputy" problem. What is the current recommendation in the modern microservices world to solve it? When user agent (UA) makes authenticated call to service A, which in turn makes call to service B: UA -[user auth]-> A -[????]-> B how to pass authentication information from A, when making a call to B? Options I can think of: - pass UA token as is. This has a problem that token becomes too powerful and can be made to call any service. - pass own token and pass user auth info as an additional field. This doesn't solve confused deputy problem, since own token can be used with any user auth and service B can be tricked to make request for data in B not belonging to user - Mint new unique token derived from tuple (A own token, UA token, B service name). B then extracts user information from the token presented by A and authorizes request. This seems to solve confused deputy problem, because A has no access to other UA tokens, so it can't mint a new token for a wrong user. Downside is that token minting should probably be done in another service and it requires making a call to it for almost every request between two microservices, making it a bottleneck pretty quickly. I've never seen last one in real life, maybe it has some critical flaws I am failing to see?
- majkinetor 6y agoAFAIK keycloack by RedHat which is auth as service, passes token as is. Not sure what you mean by "token becomes too powerful and can be made to call any service." Each sub-service can have in token what is required to access it, and that can be managed by main frontend service. There is a limit to token size but you can easily optimize claims and stuff to not go overboard in majority of cases.
- rossmohax 6y ago> token becomes too powerful and can be made to call any service. If UA token is passed as is down the chain of microservices, then every service starts to accept it. Intercepting this single token allows attacked to craws whole internal system. It wont grant access to other users data, but nevertheless it doesn't seem like a secure solution to me. > Each sub-service can have in token what is required to access it, and that can be managed by main frontend service. This would require UA token to contain audience claim of every single internal service, this is unlikely to pass security review.
- jacquesm 6y agoIf it's on youtube, it isn't private.
- majkinetor 6y agoAmazing "tutorial". It definitely made me rethink each of interactions on my services.
- hackerpain 6y agoThis bug was found by my friend. David has found many creative bugs and we worked on a project together :) Must say a quick thinker, and he's just 17 or 18.
- thoughtsunifi12 6y agodelete thoughtsunufic account
- colek42 6y agoTransitive identity is a difficult problem. SPIFFE has a working group to set up to try to solve it. https://groups.google.com/a/spiffe.io/g/transitive-identity-wg?pli=1 https://groups.google.com/a/spiffe.io/g/transitive-identity-...
- mk89 6y agoThis is indeed probably one of the most common issues with all these independent services/microservices/let's build this fast/I just need that fragment of the API, so I am not gonna call the main API, let me just build a fast wrapper around it/...etc. This is absolutely one of the biggest issues I also have seen in several companies.
- blindm 6y agoIt's worth mentioning that many smartphone users upload content to Youtube seemingly mistakenly and unaware that they are doing so (also known as fat-fingering[0]). A quick search for: DSC001.mp4 And then filtering that by recently uploaded always yields interesting results. For those that don't know, `DSC-XXX` is a standard naming scheme for digital cameras. More on the default naming scheme in the following link[1] [0] https://www.urbandictionary.com/define.php?term=fat-fingering https://www.urbandictionary.com/define.php?term=fat-fingerin... [1] https://datagenetics.com/blog/december22012/index.html https://datagenetics.com/blog/december22012/index.html
- newsbinator 6y agoThis doesn't seem to work well. At least I only see 1 video with this search param from the last year.
- notretarded 6y agoIf you're looking for porn, try bing
- Anthony-G 6y agoThe DataGenetics article was interesting but doesn’t explain where “DSC” comes from. Wikipedia [1] explains that it’s an abbreviation for Digital Still Camera, corroborated by the Design rule for Camera File system (DCF) [2] which also specifies “DCIM” (an abbreviation for Digital Camera IMages) as the name of the DCF image root directory. [1] https://en.wikipedia.org/wiki/Digital_camera#Digital_Still_Cameras_(DSC) https://en.wikipedia.org/wiki/Digital_camera#Digital_Still_C... [2] https://en.wikipedia.org/wiki/Design_rule_for_Camera_File_system https://en.wikipedia.org/wiki/Design_rule_for_Camera_File_sy...
- jrochkind1 6y ago"still" as in, not film/video/moving. That it's in this case moving videos named after "digital still camera" is kind of amusing.
- 6y ago
- IndySun 6y agoIt had ... an interesting feature called Moments...To be honest I am not quite sure what advertisers use this feature for, nevertheless, it seemed interesting For putting their ad at the point most relevant, maybe, or better still, putting their ad at the point to which their audience will skim to.
- dutch3000 6y agowhy would i want to look at other peoples private YT videos?
- silentsea90 6y agoOne of the few times I could follow an exploit write up completely! Smartly done and well written!
- homero 6y agoThat API should have had rate limiting at the minimum. I would never let an API call get called thousands of times.
- saagarjha 6y agoPerhaps it did, and the author waited a day or two to get all the frames.
- ed25519FUUU 6y agoI really love the author's persistence of just changing the ID at every chance. "Hacking" often carries with it the perception that it's a highly covert and technical craft, when in reality it's often times people banging on the wall in different ways until the behavior changes.
- qwertox 6y ago> First thing I did was to upload a video to my second testing account’s YouTube channel, and set the video’s privacy to Private, so I can use that video for testing. (Remember, always only test against resources/accounts you own!) AFAIK this is against YouTube's EULA, so owning a resource is irrelevant. He doesn't own the accounts, Google does. And Google prohibits any attempt at tampering with their systems.
- amenghra 6y agoGoogle also has a bug bounty program which sets terms and conditions for these kinds of activity: "When investigating a vulnerability, please, only ever target your own accounts." from https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/.
- tjbiddle 6y agoWell, Google rewarded the bug bounty, and as far as we know - didn't sue him. So, they probably think it's okay.
- sircastor 6y agoI’m sort of hesitant to pursue this, but I have one video in my favorites list that’s been made private, and I’m super curious what it was, and why I liked it in the first place.
- seebetter 6y agoA person recently made a video which was captured on Internet Archive. I can’t play but a few screen shots pop up. The video is kind of incriminating due to what the person was discussing and the fact that he deleted it.
- trhway 6y agoa bug like this suggest that Google services infrastructure isn't based on identity propagation, and instead services have full access to other services, and access control and authorization checks are performed in the client service.