3 ms·
Show HN: A Way To Hack HN's Karma
I submitted a link, when someone clicks on it I get an up-vote for this article.
I don't want people to misuse this I just want to bring attention to this problem.
This is the link I used that up-votes this: http://news.ycombinator.com/vote?for=3742742&dir=up&whence=%6e%65%77%65%73%74
- RandallBrown 15y agoWhat is the link?
- deleted 15y ago[deleted]
- GreekOphion 15y agoIf you go to this submission and click it, it up-votes this: http://news.ycombinator.com/item?id=3742745 http://news.ycombinator.com/item?id=3742745
- deleted 15y ago[deleted]
- azelfrath 15y agoI don't think this is irresponsible, exactly. Mischievous, yes, but there's not a ton of damage being done and it's something we can laugh at and say "Hey, that was pretty good."
- deleted 15y ago[deleted]
- ricardobeat 15y agoAnd how exactly would you insert an image on HN?
- olalonde 15y agoApparently you are right, the bug is not vulnerable to cross-site scripting.
- carbocation 15y agoPG could start using POST & CSRF protection to lock this down. Or we could just avoid doing this to each other.
- daeken 15y agoCSRF protection is the right way to solve this. Switching to POST doesn't provide any real protection; an attacker can simply put up a form that autosubmits to the endpoint with POST.
- Bakkot 15y agoCSRF couldn't stop this particular attack, since it's not actually cross-site. You need to guard against both.
- daeken 15y agoI think you misunderstand what CSRF protection does. It doesn't have anything to do with same-origin security, but rather preventing request forgery attacks in general. If a CSRF token was present on requests and was tied to a user's session (as is standard), then that would absolutely defend against this attack.
- freehunter 15y agoOr we could just avoid doing this to each other. Security through obscurity?
- ccarpenterg 15y agoNice hack! We should call it 'Same-site request forgery'.
- staunch 15y agoI saw this but don't really consider it much of a problem. It's the kind of thing that you can't really exploit. It'd be obvious if you really tried to use it for evil and then PG would kill your account.
- TomGullen 15y agoIf HN has some sort of redirect to any URL page (eg, redirect.ashx?url=http://www.google.com http://www.google.com I don't know if HN does but a lot of sites do in some form) then it could be exploited possibly
- kwamenum86 15y agoNot necessarily. You could make the CSRF request on, for example, 80 percent of the views to make it look legit. You could even take a more sophisticated approach and start by automatically upvoting for 100 percent of logged in users just to get on the front page and dampening once your story rises in the rankings.
- staunch 15y agoAnd if any users notice your account and domain are banned. Not saying it shouldn't be fixed but I doubt you would have much luck exploiting this at any scale.
- citricsquid 15y agoI had always assumed this was impossible because my votes have an auth key attached. Does this mean that the auth key is not used and is just there to trick casual observers into thinking there is security? vote?for=3742852&dir=up&by=citricsquid&auth=478876d54494692615d9f2ca184fa9fab2fb9ff7&whence=%69%74%65%6d%3f%69%64%3d%33%37%34%32%37%34%32
- kwamenum86 15y agoI'm guessing this security hole is a regression because I could have sworn I tried this before. But I don't remember for certain.
- jpulgarin 15y agoThat parameter is absent when you're not logged in.
- wglb 15y agoThis is for the comment votes; it looks like the vote for articles doesn't have a token.
- rickdale 15y agoIs that how this story became number 1 without a pg comment? If this was serious you would think pg would have commented.
- ssclafani 15y agoI emailed PG about this a week ago, his response: "It just seems to." Normally loading the vote URL directly doesn't work because votes that don't have a HN referrer don't get counted. By submitting the URL to HN and getting people to click through a HN referrer gets sent making the votes look legitimate.
- deadmike 15y agoAn interesting bug, but if anything won't it just earn you fake points on a website, while making everyone on that website hate the account that's accruing the points, essentially making those "hacked" points' meaning moot anyway?
- olalonde 15y agoNow that it's out there, I made a self up voting version: http://news.ycombinator.com/edit?id=3742902 http://news.ycombinator.com/edit?id=3742902
- GreekOphion 15y agoLet's try not to ruin the Front Page with a bunch of these. I believe one is enough.
- deleted 15y ago[deleted]
- goo 15y agoI'm fairly certain that unless the referer is the "new" page, it counts negatively toward the story's promotion.
- MichaelApproved 15y agoThe #1 post on HN is exploiting this and it's working just fine.