15 ms·
Clubhouse data leak: 1.3M user records leaked online for free
- _trampeltier 6y ago2021 the year of leaks ..
- quickthrower2 6y agoHopefully this is a good omen for Julian
- o_m 6y agoNot really. It seems like we have redefined what a leak is.
- jtokoph 6y agoIt looks like someone just scraped all of the public profiles.
- bloudermilk 6y agoYup, this seems to be the case. I don’t know how this could be characterize as a leak?
- eswat 6y agoIt's definitely a grey area here. Clubhouse strongly encourages using real names on their platform. That can be considered personal information that should be protected by security controls that they seem to lack, based on what others have mentioned here, that could have limited this "leak".
- Zealotux 6y agoIt looks more like a SQL dump to me. The data doesn't seems to be too critical however.
- frombody 6y agoIf I were collecting a large amount of data, I would most likely store it in a database.
- eurasiantiger 6y agoActive data yes, archived data goes into the warehouse.
- tW4r 6y agoHow so? It is exactly the data you see when you open any clubhouse profile in the app Almost as if there was an endpoint /profiles/id that someone just scrapped by using id 0..9999999999
- vidarh 6y agoOne of the first places I worked they had that. For private data. Guess their user id and you could get someones whole contact list, access their voicemail, or start a 30 person conference call which could dial out internationally with calls billed to the affected user... The entire top management had user ids below 100... I found the problem because on login all it set was a cookie with the userid, and so of course I tried changing it. When I alerted my manager to the problem they put in place 'encryption' of said cookie. It was base64 encoding. They were shocked when I broke that too. Writing this now it sounds invented, but it's not. To be fair this was more than 20 years ago, and a lot of developers did not yet have any understanding of security, so they at least had a shred of an excuse. I left that company first chance I got.
- Cheezmeister 6y ago> 'encryption' of said cookie...It was base64 encoding. Made me chuckle.
- vidarh 6y agoI never figured out what thought process led to them considering base64 a security feature. I mean, I could tell just by looking at the cookie it was base64, but I expected that meant they'd encrypted it and then base64 encoded the result. But no. It made me treat every bit of code I was handed with extreme caution.
- lovedswain 6y agoI guess a leak requires private data to be exposed, this is just a collection of public data.
- p49k 6y agoIs it public info who invited you to the Clubhouse app? If not, that would assume some kind of breach, since that info is part of the leak.
- saurik 6y ago> Is it public info who invited you to the Clubhouse app? Yes: that is public info. This is all no more a "leak" than the original service is a "leak" of itself.
- deleted 6y ago[deleted]
- wongmjane 6y agoBesides, the name, username, profile picture, etc are publicly accessible via permalinks For example: https://www.joinclubhouse.com/@clubhouse https://www.joinclubhouse.com/@clubhouse
- ThomPete 6y agoEveryone can see who invited you to Clubhouse down in the bottom of the profile.
- Kiro 6y agoIt's not only public, it's central to the whole concept. You can always walk up your tree to see who the original member in your line is.
- gabipurcaru 6y agoSame as the recent FB and Linkedin incidents. It's all scraped data. Doesn't mean that collecting public data at scale is not something bad
- deleted 6y ago[deleted]
- rvz 6y agoFrom [0]: > This is misleading and false. Clubhouse has not been breached or hacked. The data referred to is all public profile information from our app, which anyone can access via the app or our API. So just like what happened to Parler and LinkedIn. A so-called 'data breach' of its public data via scraping. But last time I checked on the private API in a GitHub repo, Clubhouse is using integer IDs which are not random alphanumberic strings for its users. This can essentially be scraped by a while loop, incrementing all the way to whoever last signed up. Did Clubhouse even implement rate limiting to combat this? [0] https://twitter.com/joinClubhouse/status/1381066324105854977 https://twitter.com/joinClubhouse/status/1381066324105854977
- sschueller 6y agoDoes anyone remember the ATT "Hack"? These two just used curl to get e-mail address and ICC-ID of ATT iPad users which where publicly accessible. [1] It was still labeled a hack and went through the brain dead media that way. Instead of ATT getting in trouble Auernheimer got a 41 months sentence and the judge also ordered him and Spitler to pay $73,000 in restitution. [1] https://www.wired.com/2013/03/att-hacker-gets-3-years/ https://www.wired.com/2013/03/att-hacker-gets-3-years/
- FDSGSG 6y agoIf this wasn't a hack, would a SQL injection have been a hack? Where do you draw the line? What if they had exploited the heartbleed bug, would that have been a hack?
- sbarre 6y agoI think this comes down to an oft-repeated discussion of what we (society) consider the "proper" securing of data. If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Personally I think an SQL injection still falls under the above. Securing public endpoints against long-known and easily mitigated vulnerabilities is 100% the company's responsibility.. There is no "we couldn't have prevented this" bullshit defense in that case.
- mittermayr 6y agoI reported this to Clubhouse in February, no response whatsoever (I am not involved in this leak, just to be extra clear). Essentially anyone with the token from the iOS app (MITMproxy + SSL kill switch) can query through the entire public (records are cleaned) user profile database. It supports wildcard queries and just responds with some 20M records you can page through if you have the time. It luckily (!) doesn't expose e-mail and phone number, which is why I also agree with others here that this is only mildly interesting. The news won't care, however. I think at around 4M users or so they switched from auto-increasing IDs to a better numbering format, until then all records remain as-is (increasing). I think Clubhouse can fix this quite easily (limit the records returned in search!!!) and apply some harsher rate limits on a per-token basis (tokens never expire, that's another thing). I think they relied a bit too much on certificate pinning. Once that's bypassed, it's relatively easy to query your way through the data. If you managed to grab someone else's token (which doesn't expire), you impersonate them (without logging the other session out), and continue to show up/talk in rooms using the Agora SDK as that person. They also do upload phone numbers of the address book in clear-text (non-hashed), although I can see that there's not too much of a point because reverse-hashes can maybe work around this easily if not salted.
- aasasd 6y ago> Once that's bypassed Do you mean that you trick the app into accepting a wrong cert? How does one do that, apart from decompilation?
- captn3m0 6y agoYou usually recompile the app, or if you have a jailbroke phone - you can do it at runtime. But considering how the API is documented now (and alternative third party apps exist), it might not even be necessary.
- jeroenhd 6y agoJailbreaking an iPhone and using a tool like SSL Kill Switch [1] or just plain, old Frida with a script like [2] will do the job. Jailbreaking is the hard part, especially for an up to date iPhone, after that there's loads of guides you can follow that disable certificate validation for pretty much every application. It all boils down to hooking the necessary validation functions and having the APIs lie to the app code. Some apps package their own crypto helpers (often with big crypto problems) to make this harder and require actual reverse engineering, but those are a pain to maintain and it's only a matter of time before someone finds a way around them. If you can extract the symbols (so if the app has not been obfuscated well) you can use Frida's API to hook those as well through any language you like. There's even an interactive Javascript console you can hook into the apps you're hooking! Certificate pinning is a great way to protect users' security and privacy, especially in countries with questionable governments or ISPs, but it won't protect your app's secrets. [1]: https://github.com/nabla-c0d3/ssl-kill-switch2 https://github.com/nabla-c0d3/ssl-kill-switch2 [2]: https://techblog.mediaservice.net/2020/08/ios-13-certificate-pinning-bypass-for-frida-and-brida/ https://techblog.mediaservice.net/2020/08/ios-13-certificate...
- tonetheman 6y agoAll of their devs must be too busy working on an Android app to fix these minor security bugs... :)
- monkey_monkey 6y agoPerhaps we need to add a term such as "harvesting", to better distinguish between hacks/leaks and mass aggregation of public profile data.
- kulikalov 6y agoWhy is this a leak? Looks like someone scraped the data any user has access to. If this is a leak, then the cybernews.com feed should be filled with linkedin/if/fb/etc leaks every minute.
- williesleg 6y agoIt's always leaked, it's just about who has it.
- deleted 6y ago[deleted]
- hashhar 6y agoLooks like it's a scrape of public profile information from Clubhouse. Also it reads more like an advertisement for the author's services. I'd like to see a more credible source.
- coldcode 6y agoThat someone who wrote an iOS app with such a lame concept of security that anyone could dump the entire database (even if its only "public" data) in a script is not surprising, as most startups and even big companies don't give a crap about security. I've seen this way too often. If you are so cavalier about security in simple rest queries, imagine what lurks beneath not yet discovered.
- benja123 6y agoI understand why people are saying this is not a breach and I tend to agree. I do think there are some basic measures you can put in place to make this kind of abuse harder. The real problem is that most users don’t understand when they sign up for a service like clubhouse, what information is public, how easy it is for bad actors to get access to that information and how this information can be used to harm them later (phishing, identity theft etc.). Who should be educating the average non technical user about the risk of agreeing to share you information publicly and even if they knew would it actually change anything. Personally, I have hit the point where I have accepted that all my -and my families information is public and for that reason with people like my parents I tend focus on teaching them to avoid falling for phone scams and phishing.
- brown9-2 6y agoAs long as we are talking about “leaks”, someone at Clubhouse might want to look into being compliant with California’s Consumer Privacy Act: https://twitter.com/wbm312/status/1360014416087945222?s=21 https://twitter.com/wbm312/status/1360014416087945222?s=21
- ulzeraj 6y agoThis is the cherry on the top for their policy that requires real names. People never learn.
- deleted 6y ago[deleted]
- swiley 6y agoI'm completely done with centralized social media "apps." I'm not signing up for any more and other than HN I've stopped using all of them and recommended that my friends do the same (surprisingly, many have listened.)
- cblconfederate 6y agoI think we're watching the implosion of the cloud. Those leaks are not even illegal, yet they will lead to a lot of spam, a lot of phishing, and a lot of other clumsy actions by clumsy actors that will alienate users and make them more reluctant to give their information next time. At least, i hope we re post peak cloud and falling fast into the norm of the internet the way it was meant to be: pseudonymous
- runeks 6y agoI don’t get it. This “leaked” information looks like something that would be displayed on a public website for each user. As far as I can see it’s just public information, like user names and avatars on e.g. stack overflow.
- cblconfederate 6y agoThe difference is it's all in a SQL dump that any kiddo can use to spam. Ease of use matters
- zepto 6y agoDo you think this additional spam will be noticeable on top of what is already there?
- cblconfederate 6y agophone/sms spam is definitely more noticeable and actually hard to block
- asimjalis 6y agoI feel this validates their decision to only release on iOS first. On Android there would be even fewer barriers to this kind of scraping.
- rogers18445 6y agoThis data seems to have been public and free for a while... Here: https://www.kaggle.com/johntukey/clubhouse-dataset https://www.kaggle.com/johntukey/clubhouse-dataset
- xyst 6y agoThe generated graph is interesting. I guess everyone in the middle are early adopters and people with high numbers of followers. Then the clusters on the outer edges are people catering to a niche audience. Then those niche audiences spawn their own microcosm
- girlinIT 6y agoHonestly, I Clubhouse will fail. Telegram also launched a feature with podcasts. And in order to listen to lectures, you need some kind of material other than audio, so that everything is better assimilated and remembered. For this reason I use https://audext.com/ https://audext.com/