5 ms·

Taking over 60k spyware user accounts with SQL injection

241 points by mtlynch 1y ago

mtlynch 1y ago
sqlmap https://catwatchful.pink/webservice/servicios.php?operation=getDevice&imei=M6GPYXHZ95ULUFD0 ... sqlmap identified the following injection points This was the wildest part to me. I'd heard of sqlmap but I didn't realize it was so good that you can just hand it a URL that hits the database and the tool basically figures out from there how to dump the database contents if there's any SQL injection vulnerability. >Intercepting my test phone’s traffic confirms that the files are directly uploaded to Firebase, and reveals that the commands for features like live photos are also handled through FCM. This is going to reduce our attack surface by a lot - nothing in Firebase is going to be IDORable or vulnerable to SQLI, and some quick testing eliminates any of the usual traps like open storage buckets or client-side service account credentials. I was surprised at how the malware devs made such sloppy mistakes but being on Firebase protected them from more severe vulnerablities. I've seen other vendors get popped by configuring Firebase incorrectly, but it seems like if you configure the basics right, it cuts down the attack surface a lot.
- supriyo-biswas 1y ago
  The incorrect Firebase configuration usually stems from people trying to have the frontend write database entries directly, however these developers usually had an old-school backend sending structured objects to Firebase, so that issue was kinda mitigated.
- sigmoid10 1y ago
  >I'd heard of sqlmap but I didn't realize it was so good The blog correctly explains how it has become pretty useless in our age where noone writes their own database integration anymore and everyone uses off-the-shelf components, but man... I remember a time when it felt like literally every sufficiently complex web service was vulnerable to sql injection. You could write a small wrapper for sqlmap, hook it up to the results of a scraper, let it run over night on every single piece of data sent to the server and the next day you'd have a bunch of entry points to choose from. It even handled WAFs to some degree. I'm out of it-sec for several years now, but I still remember every single command line argument for sqlmap like it was yesterday.
  - technion 1y ago
    Ive always admired hn for bringing me people in very different spaces. Of the development teams I've worked with in the last year pretty much all of them were writing injectable code by default. Ive got an email from an executive in a saas telling me they aren't worried because they geofilter china.
    - fancyswimtime 1y ago
      what?
    - Lucasoato 1y ago
      Implying Chinese hackers can't use a VPN to bypass that geofilter lol
      - GuB-42 1y ago
        Even more ironic considering that China already geofences itself and using a VPN it pretty much a requirements if you want to communicate with the outside world. Chances are that these hackers are bypassing that filter without even realizing it.
        jojobas 1y ago
        Chinese state-employed hackers don't have to worry about VPNs.
        GuB-42 1y ago
        I wonder how many of these "state-employed hackers" are just random criminals and their bots, doing regular criminal stuff like stealing money from bank accounts. I easily see people claiming they are the target of a foreign government because it gives them importance and it is less shameful than a spam botnet.
    - transcriptase 1y ago
      The real security pros set their keyboard language to Russian.
- RankingMember 1y ago
  I agree, I'm blown away at the level to which this kind of probing and exfiltration has been abstracted. Not quite surprised that years of iteration have led to this, but still, I didn't realize it'd become this easy.
- jerf 1y ago
  "I'd heard of sqlmap but I didn't realize it was so good that you can just hand it a URL that hits the database and the tool basically figures out from there how to dump the database contents if there's any SQL injection vulnerability." If there's one lesson I'd convey to people about security it is do not underestimate your foes. They've been building tools for decades just like any other discipline. Tech to find a hole in your system that lets you run an arbitrary-but-constrained fragment of shell code that can put a small executable on to the system that puts a larger executable on that lifts itself up to root and also joins a centralized command-and-control server with the ability to push arbitrary code across entire clusters of owned systems is not some sort of bizarre, exotic technology that people only dream of... it's off-the-shelf tech. It's a basic building block. Actually sophisticated attackers build up from there. If $YOU're operating on the presumption I see so often that the script kiddies blind-firing Wordpress vulnerabilities at servers is the height of attacker's sophistication $YOU are operating at an unrecoverable disadvantage against these people.
- pinoy420 1y ago
  [dead]
- nneonneo 1y ago
  sqlmap not only figures out how to dump the DB, they even provide a handy "shell" mode that parses SQL, converts it into an injection payload, and executes it on the server. It feels just like having a mysql or sqlite etc. shell. It even supports things like reading files and executing commands (!) if the server supports them (and if the DB user has the appropriate credentials). Even better, it knows how to exploit blind SQLi and has a number of tricks for doing so: it can often tell if a query is succeeding or failing based on HTTP error codes, and it will do things like try various SLEEP() injections to see if it can hang the server. If it finds any blind SQLi opportunities, it has the ability to dump the entire database *one bit at a time* by just doing a ton of requests in parallel. You can actually hand it a file full of HTTP request headers and it'll automatically figure out where the potential injection points are, and send a bunch of requests formatted identically to the provided headers. You can practically automate SQL injection testing with a suitable MITM proxy and some scripting. It has options for disguising requests, for bypassing WAFs, for submitting requests using custom protocols, and a ton more. Just a really well designed tool overall.
- tonyhart7 1y ago
  this php webserver, its no wonder
ryanrasti 1y ago
> Q: Can I monitor a phone without them knowing? > A: Yes, you can monitor a phone without them knowing with mobile phone monitoring software. The app is invisible and undetectable on the phone. It works in a hidden and stealth mode. How is that even possible on a modern Android? I'd think one of the explicit goals of the security model would be to prevent this.
- ridgewell 1y ago
  I'm not familiar with this app but based on the read, it sounds like they're essentially relying on someone to sneak into the target's phone, install an apk with a 'Settings' logo, where you grant it all permissions (I assume the installer facilitates the process of manually granting full permissions for each permissions type and disabling battery optimization). Android does allow you to effectively delegate full permissions to an app like that, albeit in a manual way.
  - afarah1 1y ago
    Camera and microphone usage should be hard-wired to an LED
    - Polizeiposaune 1y ago
      and a switch which has a physical air gap when off.
      - itslennysfault 1y ago
        Thanks for your suggestion, but at this time the NSA cannot allow this change.
        ryanrasti 1y ago
        Haha! That gave me a good laugh.
        aitchnyu 1y ago
esaym 1y ago
> The live photo and microphone options are particularly creepy, successfully taking a photo or recording and uploading it for me to view near-instantly on the control panel without giving the phone user the slightest sign that anything is amiss Oh dear.
blueplanet200 1y ago
From sqlmap > Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program" I don't know the legal footing these spyware apps stand on, but this blog post seems like exhibit A if Catwatchful ever decided to sue the author, or press criminal charges. Hacking, even for reasons that seem morally justified, is still illegal.
- VWWHFSfQ 1y ago
  Yeah this whole exercise was completely illegal and I'm surprised this person publicly (and proudly) blogged about it like this. They probably need to engage an attorney now.
  - SoftTalker 1y ago
    Author is in Canada, not sure if/how that changes things.
  - mtlynch 1y ago
    The server they compromised is essentially a command and control server for an illegal botnet. Are there documented cases of botnet owners trying to sue or get law enforcement to prosecute someone for infiltrating their botnet? I'd be more concerned about extralegal retaliation from people in the malware ecosystem.
    - dylan604 1y ago
      Hey, that's my server, and is totally 100% legit. I was unaware that I was pwnd and someone was using it as a C&C server. I'm now suing you for hacking my server, as you could be the person that installed the C&C server. After all, you are an admitted hacker. Stranger things have won in court
  - rendall 1y ago
    Your theory is that Daigle is at risk of a Canadian prosecutor hauling him into court based on the criminal complaint of a Uruguayan purveyor of stalkerware? That's novel.
bspammer 1y ago
It's unexpected to me that someone with the technical knowhow to build spyware like this and a nice web interface for it, made basic mistakes like storing passwords in plaintext and piping unescaped user input into database queries.
- vpShane 1y ago
  They'll usually get the bases for already existing things and then add in their own stuff at a much lower quality.
- imzadi 1y ago
  I'd be willing to bet that getting their user's passwords is part of their goal. So they would need to be stored somewhere.
- andoando 1y ago
  They probably just didn't care to
- sbarre 1y ago
  Something I've learned over the years is that even very talented developers can be really bad at security. In many cases it's just not something that's taught at school or that is covered in training. So it's a mindset that just isn't there, even when they're great at other parts of the craft. If you're building anything that is going to be exposed to the public Internet and you aren't, at some point, going through the exercise of "how can people break or abuse or hack this" then you're missing a step for sure.
- ethan_smith 1y ago
  Malware developers often prioritize functionality and speed-to-market over security hygiene, operating under the "security through obscurity" fallacy that nobody will bother attacking their infrastructure.
JohnMakin 1y ago
some time ago I was having super weird phone issues (iphone) and narrowed it down to one of these services. I clearly had been 0 click vuln’d because I couldnt fathom how else it could have been infected, but had no idea who or why, still dont know. felt extremely gross and I have absolutely zero sympathy for any users or operators of these services and think this researcher was far too polite about it.
- normie3000 1y ago
  How did you diagnose the issue? My iPhone feels like an appliance, and an increasingly slow and buggy one at that!
  - DownGoat 1y ago
    Reboot the phone. This sort of stuff is not really possible on iPhone. None of the fancy spyware on iPhone survives reboots.
    - JohnMakin 1y ago
      this was apple's advice as well, but alas, the only thing that remediated it was a full factory reset. /shrug
    - normie3000 1y ago
      > Reboot the phone. This doesn't sound like a satisfying step in debugging. On the other hand, confirms my appliance feelings.
ceva 1y ago
Someone who is in malware business will 100% not sue you for what you did, i wouldn't worry about that at all. You did a good job!
gpm 1y ago
The TechCrunch article says > Google said it added new protections for Google Play Protect But the screenshot of the device settings in the article shows that the app has you turn off Google Play Protect. So does this even do anything? Meanwhile Google (via its firebase brand) is apparently continuing to act as a host for this app...
zero_k 1y ago
Sometimes, I wish engineers running backend services were not hindered by management nonsense and would just nuke these systems when they are reported, sufficiently backed up with evidence (like here -- though I'd do a personal check first to verify). Seems like some did (congrats), others didn't (Firebase). I can assure you if I was on the other end, I would have escalated until I got fired or the service was down. Unimaginable that some let these run, wake up in the morning, look in the mirror and aren't ashamed of themselves. People will continue doing their unethical behaviour not because we aren't on the streets fighting for the right thing, but because we just don't care enough, and let them continue.
bluelightning2k 1y ago
isn't using software like this deeply illegal? or is that a legislative blind-spot? seems like this database should be sent to the FBI and someone can make a career out of prosecuting

241 points by mtlynch 1y ago

sqlmap https://catwatchful.pink/webservice/servicios.php?operation=getDevice&imei=M6GPYXHZ95ULUFD0 ... sqlmap identified the following injection points This was the wildest part to me. I'd heard of sqlmap but I didn't realize it was so good that you can just hand it a URL that hits the database and the tool basically figures out from there how to dump the database contents if there's any SQL injection vulnerability. >Intercepting my test phone’s traffic confirms that the files are directly uploaded to Firebase, and reveals that the commands for features like live photos are also handled through FCM. This is going to reduce our attack surface by a lot - nothing in Firebase is going to be IDORable or vulnerable to SQLI, and some quick testing eliminates any of the usual traps like open storage buckets or client-side service account credentials. I was surprised at how the malware devs made such sloppy mistakes but being on Firebase protected them from more severe vulnerablities. I've seen other vendors get popped by configuring Firebase incorrectly, but it seems like if you configure the basics right, it cuts down the attack surface a lot.

supriyo-biswas 1y ago
The incorrect Firebase configuration usually stems from people trying to have the frontend write database entries directly, however these developers usually had an old-school backend sending structured objects to Firebase, so that issue was kinda mitigated.
sigmoid10 1y ago
>I'd heard of sqlmap but I didn't realize it was so good The blog correctly explains how it has become pretty useless in our age where noone writes their own database integration anymore and everyone uses off-the-shelf components, but man... I remember a time when it felt like literally every sufficiently complex web service was vulnerable to sql injection. You could write a small wrapper for sqlmap, hook it up to the results of a scraper, let it run over night on every single piece of data sent to the server and the next day you'd have a bunch of entry points to choose from. It even handled WAFs to some degree. I'm out of it-sec for several years now, but I still remember every single command line argument for sqlmap like it was yesterday.
- technion 1y ago
  Ive always admired hn for bringing me people in very different spaces. Of the development teams I've worked with in the last year pretty much all of them were writing injectable code by default. Ive got an email from an executive in a saas telling me they aren't worried because they geofilter china.
  - fancyswimtime 1y ago
    what?
  - Lucasoato 1y ago
    Implying Chinese hackers can't use a VPN to bypass that geofilter lol
    - GuB-42 1y ago
      Even more ironic considering that China already geofences itself and using a VPN it pretty much a requirements if you want to communicate with the outside world. Chances are that these hackers are bypassing that filter without even realizing it.
      - jojobas 1y ago
        Chinese state-employed hackers don't have to worry about VPNs.
        GuB-42 1y ago
        I wonder how many of these "state-employed hackers" are just random criminals and their bots, doing regular criminal stuff like stealing money from bank accounts. I easily see people claiming they are the target of a foreign government because it gives them importance and it is less shameful than a spam botnet.
  - transcriptase 1y ago
    The real security pros set their keyboard language to Russian.
RankingMember 1y ago
I agree, I'm blown away at the level to which this kind of probing and exfiltration has been abstracted. Not quite surprised that years of iteration have led to this, but still, I didn't realize it'd become this easy.
jerf 1y ago
"I'd heard of sqlmap but I didn't realize it was so good that you can just hand it a URL that hits the database and the tool basically figures out from there how to dump the database contents if there's any SQL injection vulnerability." If there's one lesson I'd convey to people about security it is do not underestimate your foes. They've been building tools for decades just like any other discipline. Tech to find a hole in your system that lets you run an arbitrary-but-constrained fragment of shell code that can put a small executable on to the system that puts a larger executable on that lifts itself up to root and also joins a centralized command-and-control server with the ability to push arbitrary code across entire clusters of owned systems is not some sort of bizarre, exotic technology that people only dream of... it's off-the-shelf tech. It's a basic building block. Actually sophisticated attackers build up from there. If $YOU're operating on the presumption I see so often that the script kiddies blind-firing Wordpress vulnerabilities at servers is the height of attacker's sophistication $YOU are operating at an unrecoverable disadvantage against these people.
pinoy420 1y ago
[dead]
nneonneo 1y ago
sqlmap not only figures out how to dump the DB, they even provide a handy "shell" mode that parses SQL, converts it into an injection payload, and executes it on the server. It feels just like having a mysql or sqlite etc. shell. It even supports things like reading files and executing commands (!) if the server supports them (and if the DB user has the appropriate credentials). Even better, it knows how to exploit blind SQLi and has a number of tricks for doing so: it can often tell if a query is succeeding or failing based on HTTP error codes, and it will do things like try various SLEEP() injections to see if it can hang the server. If it finds any blind SQLi opportunities, it has the ability to dump the entire database *one bit at a time* by just doing a ton of requests in parallel. You can actually hand it a file full of HTTP request headers and it'll automatically figure out where the potential injection points are, and send a bunch of requests formatted identically to the provided headers. You can practically automate SQL injection testing with a suitable MITM proxy and some scripting. It has options for disguising requests, for bypassing WAFs, for submitting requests using custom protocols, and a ton more. Just a really well designed tool overall.
tonyhart7 1y ago
this php webserver, its no wonder

ryanrasti 1y ago

> Q: Can I monitor a phone without them knowing? > A: Yes, you can monitor a phone without them knowing with mobile phone monitoring software. The app is invisible and undetectable on the phone. It works in a hidden and stealth mode. How is that even possible on a modern Android? I'd think one of the explicit goals of the security model would be to prevent this.

ridgewell 1y ago
I'm not familiar with this app but based on the read, it sounds like they're essentially relying on someone to sneak into the target's phone, install an apk with a 'Settings' logo, where you grant it all permissions (I assume the installer facilitates the process of manually granting full permissions for each permissions type and disabling battery optimization). Android does allow you to effectively delegate full permissions to an app like that, albeit in a manual way.
- afarah1 1y ago
  Camera and microphone usage should be hard-wired to an LED
  - Polizeiposaune 1y ago
    and a switch which has a physical air gap when off.
    - itslennysfault 1y ago
      Thanks for your suggestion, but at this time the NSA cannot allow this change.
      - ryanrasti 1y ago
        Haha! That gave me a good laugh.
      - aitchnyu 1y ago

esaym 1y ago

> The live photo and microphone options are particularly creepy, successfully taking a photo or recording and uploading it for me to view near-instantly on the control panel without giving the phone user the slightest sign that anything is amiss Oh dear.

blueplanet200 1y ago

From sqlmap > Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program" I don't know the legal footing these spyware apps stand on, but this blog post seems like exhibit A if Catwatchful ever decided to sue the author, or press criminal charges. Hacking, even for reasons that seem morally justified, is still illegal.

VWWHFSfQ 1y ago
Yeah this whole exercise was completely illegal and I'm surprised this person publicly (and proudly) blogged about it like this. They probably need to engage an attorney now.
- SoftTalker 1y ago
  Author is in Canada, not sure if/how that changes things.
- mtlynch 1y ago
  The server they compromised is essentially a command and control server for an illegal botnet. Are there documented cases of botnet owners trying to sue or get law enforcement to prosecute someone for infiltrating their botnet? I'd be more concerned about extralegal retaliation from people in the malware ecosystem.
  - dylan604 1y ago
    Hey, that's my server, and is totally 100% legit. I was unaware that I was pwnd and someone was using it as a C&C server. I'm now suing you for hacking my server, as you could be the person that installed the C&C server. After all, you are an admitted hacker. Stranger things have won in court
- rendall 1y ago
  Your theory is that Daigle is at risk of a Canadian prosecutor hauling him into court based on the criminal complaint of a Uruguayan purveyor of stalkerware? That's novel.

bspammer 1y ago

It's unexpected to me that someone with the technical knowhow to build spyware like this and a nice web interface for it, made basic mistakes like storing passwords in plaintext and piping unescaped user input into database queries.

vpShane 1y ago
They'll usually get the bases for already existing things and then add in their own stuff at a much lower quality.
imzadi 1y ago
I'd be willing to bet that getting their user's passwords is part of their goal. So they would need to be stored somewhere.
andoando 1y ago
They probably just didn't care to
sbarre 1y ago
Something I've learned over the years is that even very talented developers can be really bad at security. In many cases it's just not something that's taught at school or that is covered in training. So it's a mindset that just isn't there, even when they're great at other parts of the craft. If you're building anything that is going to be exposed to the public Internet and you aren't, at some point, going through the exercise of "how can people break or abuse or hack this" then you're missing a step for sure.
ethan_smith 1y ago
Malware developers often prioritize functionality and speed-to-market over security hygiene, operating under the "security through obscurity" fallacy that nobody will bother attacking their infrastructure.

JohnMakin 1y ago

some time ago I was having super weird phone issues (iphone) and narrowed it down to one of these services. I clearly had been 0 click vuln’d because I couldnt fathom how else it could have been infected, but had no idea who or why, still dont know. felt extremely gross and I have absolutely zero sympathy for any users or operators of these services and think this researcher was far too polite about it.

normie3000 1y ago
How did you diagnose the issue? My iPhone feels like an appliance, and an increasingly slow and buggy one at that!
- DownGoat 1y ago
  Reboot the phone. This sort of stuff is not really possible on iPhone. None of the fancy spyware on iPhone survives reboots.
  - JohnMakin 1y ago
    this was apple's advice as well, but alas, the only thing that remediated it was a full factory reset. /shrug
  - normie3000 1y ago
    > Reboot the phone. This doesn't sound like a satisfying step in debugging. On the other hand, confirms my appliance feelings.

ceva 1y ago

Someone who is in malware business will 100% not sue you for what you did, i wouldn't worry about that at all. You did a good job!

gpm 1y ago

The TechCrunch article says > Google said it added new protections for Google Play Protect But the screenshot of the device settings in the article shows that the app has you turn off Google Play Protect. So does this even do anything? Meanwhile Google (via its firebase brand) is apparently continuing to act as a host for this app...

zero_k 1y ago

Sometimes, I wish engineers running backend services were not hindered by management nonsense and would just nuke these systems when they are reported, sufficiently backed up with evidence (like here -- though I'd do a personal check first to verify). Seems like some did (congrats), others didn't (Firebase). I can assure you if I was on the other end, I would have escalated until I got fired or the service was down. Unimaginable that some let these run, wake up in the morning, look in the mirror and aren't ashamed of themselves. People will continue doing their unethical behaviour not because we aren't on the streets fighting for the right thing, but because we just don't care enough, and let them continue.

bluelightning2k 1y ago

isn't using software like this deeply illegal? or is that a legislative blind-spot? seems like this database should be sent to the FBI and someone can make a career out of prosecuting