7 ms·
We found critical vulnerabilities in Hive Social
- rurcliped 4y agoAt least one other person reported Hive Social vulnerabilities recently: https://twitter.com/zhuowei/status/1597739467645030400 https://twitter.com/zhuowei/status/1597739467645030400
- spindle 4y agosummary quotes: > The issues we reported allow any attacker to access all data, including private posts, private messages, shared media and even deleted direct messages. This also includes private email addresses and phone numbers entered during login. > Attackers can also overwrite data such as posts owned by other users
- charcircuit 4y agono authorization on some endpoints + enumeration I presume
- StanislavPetrov 4y agoJust want to point out that Hive Social is completely unrelated to Hive Blog (which is also a social network of sorts on the Hive blockchain). https://hive.blog/ https://hive.blog/
- leoh 4y agoOh, thank goodness the other hive is as safe as crypto.
- namkt 4y agoIs there a 'rick-rolled' meme but with blockchain?
- panzi 4y agoThere also seems to be something similar to Slack that's called Hive. Not very unique name.
- Tepix 4y agoAlso unrelated to TheHive project, a security incident response tool. https://thehive-project.org/ https://thehive-project.org/
- drunkenmagician 4y ago4 days from reporting to public posting is not a responsible disclosure policy. Even if they are slow in responding, the usual grace period is about 4 weeks if I recall.
- endigma 4y agoThey don't offer a guide or any details about the exploit, this isn't really disclosure in the normal sense. Aside from any possible alterior motives the author may be just trying to light a fire under hive social's ass to get it fixed.
- joe-collins 4y agoIn kindness and for future reference, the word you're looking for is spelled "ulterior".
- yellow_lead 4y agoThis isn't disclosure
- p1necone 4y ago1. They haven't disclosed anything of use to an attacker. 2. According to the post, Hive responded and said the issues had been fixed. Obviously they haven't, and at this point OP seems to have decided that the most responsible thing to do was to warn users of the platform that they aren't safe. I don't really see a problem with this.
- zelon88 4y ago> 1. They haven't disclosed anything of use to an attacker. I also don't believe this is "responsible" disclosure, but I also don't think it's fair to say this information is of no use. To me this clearly signifies that there is no back-end authentication on their API. The whole app is probably written in JS with a simple database on the backside with no serious middleware on the server side. It would probably not be difficult to reverse engineer this hack by monitoring requests using simple dev tools, and then simply replaying them with altered content.
- leoh 4y agoDon’t worry, I won’t. Snark aside, I think the current platforms are going to be the only ones folks use; and then there’s going to be stuff that is entirely different. These clones are getting just silly.
- Holidaylogin 4y agoIt would helpful if the reporter confirmed that this is an issue with this particular front-end and not with Hive in general. Steem/Hive was the first web3 offering and a lot of new 'web3' projects that are getting a lot of publicity have yet to catch up the basics that Steem/Hive had in place 6 years ago.
- MBCook 4y agoWrong hive. This is a social network that has recently exploded. My understanding is a ton of games industry people moved to it off Twitter. It has nothing to do with “Web3”. It’s not a front end. It’s a native iPhone app. No web presence at all at the moment.
- Holidaylogin 4y agoThanks TIL. That would be helpful information for the reporter to include too.
- MBCook 4y agoSure. Personally I’ve never heard of the Hive you’re talking about. Perhaps it was the same for the reporter.
- malermeister 4y ago+1, I'm not sure what the "other" Hive is, but it seems to have a lot less mind share, making a disclaimer unnecessary.
- deleted 4y ago[deleted]
- lehi 4y agoHive is a My First App project from a teen who taught herself to code in 2019 (https://www.hivesocial.app/about-us https://www.hivesocial.app/about-us). Caveat emptor.
- yawnxyz 4y agothat's such a success story hitting 1M users as a hobby project, let alone from a teenager. I've never done anything close to this, and not for lack of trying...
- waprin 4y agoI've been in Bay Area high tech software for a long time now, and more recently I've been participating more in the indie hacker scene. It is fascinating to me that I do know many extremely talented engineers who either dream of setting out on their own and never do, or they try and repeatedly fail. Then random novices in circumstances far removed from tech teach themselves a little coding online and start making 5 figure MRR quickly. There are somewhat obvious explanations. Coding is only one subset of the skills to launch a successful software business, and not even the most important one. There's also a huge element of randomness and luck, especially for a single given project and especially for any type of free b2c social app. Also, people outside Silicon Valley bubble have access to unique social circles that can serve as community "bootstrapping", which would be especially important for a social app Even knowing all that, there's an element of surprise when you see it happen. I do suspect another big factor is that experienced people overthink things a bit, much like a child seems to learn a language faster than an adult but may only be more willing to make silly mistakes. Many of the best startups and indie projects would never be started by many experienced engineers because they're perceived as too simple, the market is too saturated, or simply they feel they'd look foolish for trying and failing to do something simple instead of trying and failing something complex.
- canadiantim 4y agoI think it's more that people outside of tech often also have great ideas that could potentially make a great MRR quickly, but most never even try, then a lot simply fail and you never hear from them too, then there's the ones who actually do learn all the coding required and other skills to make a successful website and actually do become successful, but by then the people you hear of being successful are of course just a small subset of the people who actually had a great idea for a successful business that would make high MRR quickly. So, to me, the idea or the need being solved is the primary driver of what ultimately makes a business successful, even though of course so many skills are required, amongst other things too.
- mudream4869 4y agoTLDR: Mastodon is more secure than Hive Social.
- PaulsWallet 4y agoIs it? Can't people read your DMs on Mastodon as well? If that is your concern then seems like all things are equal. I'm being somewhat obtuse but I don't see how Mastodon is a reasonable replacement for Twitter.
- BaseballPhysics 4y ago> Is it? Can't people read your DMs on Mastodon as well? "People"? No. Server operators, yes, but that's true of Twitter as well. The disclosure, here, is that anyone can read private messages. Oh, and also edit posts.
- SrslyJosh 4y agoUnless a service or protocol provides end-to-end encryption, you should not use its messaging features for anything truly sensitive. And no, this is not equal. The Hive authors seem to have completely failed to implement authorization for their API, allowing (it seems) anyone with a valid auth token to make a request as any other user, granting everyone access to everyone else's data. This is a "car company doesn't know what seat belts are" level of incompetence.
- dncornholio 4y agoWell.. That's an understatement.
- culanuchachamim 4y agoSlightly off topic: In the video of the post you can see an option of run a script in an iPhone. What's that option? It's really an iPhone? What are the capabilities of that functionality?
- Apocryphon 4y agoWoah so it has MySpace aspects
- Kiro 4y agoWhat do you mean? iPhone is MySpace?
- Apocryphon 4y agoI meant the being able to run any customizable script aspect for a social network site. Xanga also allowed that too, iirc
- Kiro 4y agoHive Social doesn't have that. The script here is on the iPhone.
- djcannabiz 4y agoits with the shortcuts app. you can make little actions that appear in the share menu. I have one for downloading videos from twitter for example. It’s pretty limited in what it can do, but ive seen some cool shit people have made with it
- nicwolff 4y agoI once needed to download PDFs from emails, and then post just one page from each to a Web form – and all I had was an iPhone and 3G at a Caribbean beach bar. Shortcuts are less limited than I thought!
- 4y ago
- bevenky 4y agoWould love to see insights on how https://www.kooapp.com/ https://www.kooapp.com/ is?
- random314 4y agoIt's a right wing Twitter for India.
- jacooper 4y agoI wanted Mastodon to replace Twitter so we can finally see a mainstream Federated social media, to break free of corporate control over social expressions. But with the Hive there is nothing unique, its a Twitter clone, which doesn't offer any technical or operational benefits, and also no major features. if we are still going to use a centralized network, might as well just continue using Twitter, a network with an existing social circle.
- stolen_biscuit 4y agoThe problem of Twitters ownership and moderation remains
- jacooper 4y agoAs if Hive is going to be any better?
- MBCook 4y agoIt may be. I don’t know their policies. But whatever you thought of the old Twitter policy, that obviously changed. And they could’ve made that change without a new owner if they had chosen to. He who owns the server sets the rules.
- lern_too_spel 4y agojwz says Marc Andreessen is an investor, so no.
- naravara 4y agoGot a price on Andreessen being an investor in Hive? I just checked in Crunchbase and it looks like they’ve raised $3M but no specifics. And all I’m able to find is that it’s from an unnamed angel investor. $3M seems small potatoes for Andreessen unless he’s trying to do a Tab vs Diet Coke thing and corner all the options.
- zimpenfish 4y ago
- linksbro 4y agoHive just shut down their entire app: https://twitter.com/TheHIVE_Social/status/1598119071907991552 https://twitter.com/TheHIVE_Social/status/159811907190799155...
- riffic 4y agohaha the only ethical alternative is the ActivityPub ecosystem. If that (Mastodon or other implementations) are not good enough, make your own or get involved with the W3C to standardize AP v2.
- joe_the_user 4y agoOf course and ironically, I can't tell whether this is the real Twitter of Hive. I wonder if I'll be able to determine the real Hive of Twitter if things switch.
- sacrosancty 4y agoSame problem their website has. And every website. You can still find out who someone is without relying on the platform to to the identity checks.
- hellweaver666 4y agoTo be fair to them... thats a brave step for a startup to take. So many would try to stay quiet and fix the issues behind the scenes (hell, giant companies try this attempt all the time!). They made the right move here. NB, I don't use Hive and have no interest, I moved to Mastodon because I want to be in control of my data moving forward.
- rideontime 4y agoit would have been brave if they'd done so when they were alerted to the issues. doing so once they've been made public? not so much.
- bagels 4y agoThey couldn't have given them even a week before disclosing? Seems more black hat than white hat to do the disclosure this way (resulted in the app getting taken down).
- toofy 4y ago> After multiple attempts to contact the company we finally reached them by phone and they acknowledged the report. After multiple days and multiple reminders by us, they claimed to have fixed all issues. However multiple vulnerabilities we reported still exist... its a bit unfair to imply they engaged in some kind of irresponsible disclosure, they haven't disclosed any of the exploits.
- ThePowerOfFuet 4y agoDid you really have to add one of the internet's most-hated songs to your screen recording like it was some cheap TikTok?
- gundmc 4y agoYeah, that seemed quite immature and unnecessary.
- csande17 4y agoCritical security vulnerability in an iOS-exclusive app? I bet they're using CloudKit and forgot to implement server-side access control. (Even Apple screws that up half the time: https://labs.detectify.com/2021/09/13/hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts/ https://labs.detectify.com/2021/09/13/hacking-cloudkit-how-i...)
- dncornholio 4y agoWouldn't be surprised if it was just replacing a post ID in the update call to someone else's post and server thinks it's fine. Anyone investigated yet? [edit] Just read they took the server down, we will never know now. [edit2] Astonishing how supportive the users are. I don't think a lot of users want to understand that all their data is on the streets. It's like they're actually deciding in what they want to believe. Seems to be a trend in society.