7 ms·

The security hole I found on Amazon.com

139 points by joshfraser 12y ago

rhgraysonii 12y ago
Anyone have a link to a more detailed writeup on exactly how this was implemented?
- joshfraser 12y ago
  I can post the code. It just doesn't work anymore since they fixed the hole. Edit: https://gist.github.com/joshfraser/819308dbae43ff70d892 https://gist.github.com/joshfraser/819308dbae43ff70d892
  - canadaj 12y ago
    Please do, it would be interesting to see how it works.
- joshfraser 12y ago
  This hack is classic clickjacking. I created a transparent iframe containing a product page on amazon.com that had been carefully positioned so when you think you’re clicking on my page, you’re actually clicking the “Buy now” button on their site instead. Here’s the link to the code for the no longer working proof of concept: https://gist.github.com/joshfraser/819308dbae43ff70d892 https://gist.github.com/joshfraser/819308dbae43ff70d892
id 12y ago
Blog appears to have some issues: "Your PHP installation appears to be missing the MySQL extension which is required by WordPress."
- themodelplumber 12y ago
  Gutsy move, posting to HN about a security vulnerability at Amazon. And using WordPress to do it. I'll bet this guy loves playing on cliffs, too.
  - joshfraser 12y ago
    I would hope my blog would be easier to hack than Amazon. Playing on cliffs and rock climbing is fun, btw. :)
  - rabino 12y ago
    Why? You have a lot of ways to hack a WordPress site?
    - deleted 12y ago
      [deleted]
    - daeken 12y ago
      > <azonenberg> wordpress is an unauthenticated remote shell that, as a useful side feature, also contains a blog That's an old joke and obviously an exaggeration, but it's not horribly far off. Wordpress instances fall to attack constantly, due to a combination of bugs in the base application itself (not terribly common) and extensions (not just common -- CONSTANT). In terms of breakability, I would rank Wordpress in the top 1% of applications without a second thought.
      - georgestephanis 12y ago
        If you believe you're aware of any security issues with WordPress core itself, Automattic is running a Bug Bounty program over on HackerOne here: https://hackerone.com/automattic/ https://hackerone.com/automattic/ -- responsible disclosure, bug bounties, and making the web a safer place is awesome.
        nomedeplume 12y ago
        You really think some piddling Automattic bounty is more valuable than a WordPress 0day?!?!?!?!? (Conscious punctuation.) I'm at a loss for words, scaredy-cat.
        notfoss 12y ago
- joshfraser 12y ago
  Sorry about that. I tried to push the POC code to my blog and forgot that Heroku doesn't like the version of Wordpress I'm running. Should be back up now.
deleted 12y ago
[deleted]
fletchowns 12y ago
Why did it take months for Amazon to fix it?
- joshfraser 12y ago
  I have no idea. Adding a single HTTP header seems simple to me, but I have no idea what their architecture looks like. It took them an entire month to send me a "thanks, we're working on it" email and that was only after I followed up with them.
  - mike-cardwell 12y ago
    They probably spent most of the time investigating to make sure that adding the header wasn't going to break anything.
    - joshfraser 12y ago
      Yep, they may have had widgets or legitimate framing that they needed to handle.
- phil21 12y ago
  Sounds about the right amount of time for a dev cycle in a large corporation. Yes, I may be a bit bitter...
  - fletchowns 12y ago
    Yeah for a normal dev cycle. Security fixes do not need to follow a normal dev cycle.
- greenyoda 12y ago
  Probably because you can't do much by exploiting this security hole besides annoying people, so there's little incentive to do so. If you can get me to click on an item and buy it, the item will be shipped to my physical address, not yours. Even if was a product you were selling, I could return it for a refund and your account would be charged back. It doesn't seem like a very profitable scheme.
0h139 12y ago
Hope you got a bounty!
- joshfraser 12y ago
  Nope. Not even a t-shirt.
  - mathattack 12y ago
    D'oh! I think you deserve at least a gift certificate!
  - ohashi 12y ago
    That sucks. It makes responsible disclosure seem marginally less attractive without any type of reward. I am sure most people would either do it or not, but there's probably some on the fence. And some people might actually start looking knowing there was a legitimate reward.
    - DougBTX 12y ago
      There's a bit of back and forth between intrinsic and extrinsic motivation, where an external reward can reduce intrinsic motivation more than it increases extrinsic motivation. That is, if the reward is known but small, someone could go form, "I'll submit this since I want to help them out," to, "I'm not going to work for below minimum wage!" http://en.wikipedia.org/wiki/Motivation#Intrinsic_and_extrinsic_motivation http://en.wikipedia.org/wiki/Motivation#Intrinsic_and_extrin...
      - ohashi 12y ago
        So make it more than minimum wage. Problem solved.
jarrett 12y ago
Clickjacking is especially scary because most web apps are probably vulnerable. The default httpd.conf that ships with most package managers doesn't include the X-Frame-Options header. (Perhaps it should.) Based on my testing, it appears Rails does not add that header either. Do any other frameworks?
- ludwigvan 12y ago
  Django has a middleware: https://docs.djangoproject.com/en/dev/ref/clickjacking/ https://docs.djangoproject.com/en/dev/ref/clickjacking/ However, it is not turned on by default on old versions (<1.6) I believe, but latest versions should be fine: https://docs.djangoproject.com/en/dev/topics/http/middleware/#activating-middleware https://docs.djangoproject.com/en/dev/topics/http/middleware... .
- garethadams 12y ago
  Rails 4 includes that as a default header[1] and has done since August 2012[2] [1]: https://github.com/rails/rails/blob/master/guides/source/security.md#default-headers https://github.com/rails/rails/blob/master/guides/source/sec... [2]: https://github.com/rails/rails/commit/2a290f7f7cdf775491eda05b3690be6d96cd9bf6 https://github.com/rails/rails/commit/2a290f7f7cdf775491eda0...
  - jarrett 12y ago
    It appears we're each partially right: If you generated a new Rails app after August 2012, you get the header by default. If you generated the app before August 2012, you do not get the header by default. So PSA: Updating Rails in an existing app does not cause this header to be added. You must add it yourself in application.rb if it's not already there. See garethadams' footnote #2 above.
- homakov 12y ago
  Most frameworks/servers don't do that. It's bad design of web specs, not a bug actually. Developers don't have to remember about it... And yeah, I added default_headers to Rails a while ago.
joev_ 12y ago
Unfortunately x-frame-options does not always fix these kinds of problems. If you can get the user to click more than once on your page, you can open a tab in the background on the first click (google for popunder.js), and if you can predict click #2 a split second before it happens (e.g. zalewski's game PoC), you can bring the popunder to the front and reposition it right under their cursor. (note: amazon could fix this by detecting when opener is xdomain and requiring some minimum number of mouseover events in the page before the button is clickable).
- erikano 12y ago
  >zalewski's game PoC I googled this but found nothing relevant. Do you have a link?
  - joev_ 12y ago
    http://lcamtuf.coredump.cx/clickit/ http://lcamtuf.coredump.cx/clickit/
    - erikano 12y ago
      Thanks :)
micahgoulart 12y ago
> I resisted the temptation to use the exploit to send myself a million dollars worth of free Amazon gift cards Sorry, but that's not how Amazon's "Buy It Now" option works. It sends the item to the default address on file. So it would not be possible for the clickjacker to get it mailed to their own address.
- joshfraser 12y ago
  You can send a gift card to an email address that you specify. I can't seem to do it now, but I remember being able to pre-populate the email address using a GET variable: https://www.amazon.com/gp/product/B004LLIKVU/gcrnsts?ie=UTF8&qid=1402093716&ref_=sr_1_1&s=gift-cards&sr=1-1 https://www.amazon.com/gp/product/B004LLIKVU/gcrnsts?ie=UTF8...
- giulianob 12y ago
  Would it be possible to use this to sell items with you as a referral and get paid commission?
  - joshfraser 12y ago
    Yes, but even better, you could list your own products on Amazon and get paid whatever amount you want. Of course, there's no way to stop the email receipts from Amazon, but you might be able to get away with it for short period of time.
euank 12y ago
I find it ironic that the wikipedia page on clickjacking [0] lists exactly this exploit as the example, and yet noone has reported it or fixed it in all this time. [0]: https://en.wikipedia.org/wiki/Clickjacking#Examples https://en.wikipedia.org/wiki/Clickjacking#Examples Edit: This example was added to the wiki page in December 2009. Relevant link: https://en.wikipedia.org/w/index.php?title=Clickjacking&oldid=334778176#Example https://en.wikipedia.org/w/index.php?title=Clickjacking&oldi...
- joshfraser 12y ago
  Wow, I hadn't even noticed that.
- deleted 12y ago
  [deleted]
homakov 12y ago
"Security hole" is a loud title. Is it worth a blog post at all? meh
- joshfraser 12y ago
  I'm a big fan of your research. I debated whether to go with a more specific title like "Clickjacking with one click purchases on Amazon" but decided to keep it simple for people unfamiliar with the concept.
  - homakov 12y ago
    In fact it is a security issue but IMO you also should have emphasized: 1) amazon sucks at fixing bugs 2) clickjacking can be a serious issue
driverdan 12y ago
Simple solution: all browsers should have 3rd party cookies disabled, including iframes.
- mappum 12y ago
  If the fix was that easy, it would have been implemented by now. Doing so would prevent some useful behavior. For instance, an embeddable Facebook like button needs to run in an iframe and uses facebook.com cookies to be able to associate the like with the user.
  - junto 12y ago
    Funnily enough, I would see that as a good thing rather than a bad thing!

139 points by joshfraser 12y ago

rhgraysonii 12y ago

Anyone have a link to a more detailed writeup on exactly how this was implemented?

joshfraser 12y ago
I can post the code. It just doesn't work anymore since they fixed the hole. Edit: https://gist.github.com/joshfraser/819308dbae43ff70d892 https://gist.github.com/joshfraser/819308dbae43ff70d892
- canadaj 12y ago
  Please do, it would be interesting to see how it works.
joshfraser 12y ago
This hack is classic clickjacking. I created a transparent iframe containing a product page on amazon.com that had been carefully positioned so when you think you’re clicking on my page, you’re actually clicking the “Buy now” button on their site instead. Here’s the link to the code for the no longer working proof of concept: https://gist.github.com/joshfraser/819308dbae43ff70d892 https://gist.github.com/joshfraser/819308dbae43ff70d892

id 12y ago

Blog appears to have some issues: "Your PHP installation appears to be missing the MySQL extension which is required by WordPress."

themodelplumber 12y ago
Gutsy move, posting to HN about a security vulnerability at Amazon. And using WordPress to do it. I'll bet this guy loves playing on cliffs, too.
- joshfraser 12y ago
  I would hope my blog would be easier to hack than Amazon. Playing on cliffs and rock climbing is fun, btw. :)
- rabino 12y ago
  Why? You have a lot of ways to hack a WordPress site?
  - deleted 12y ago
    [deleted]
  - daeken 12y ago
    > <azonenberg> wordpress is an unauthenticated remote shell that, as a useful side feature, also contains a blog That's an old joke and obviously an exaggeration, but it's not horribly far off. Wordpress instances fall to attack constantly, due to a combination of bugs in the base application itself (not terribly common) and extensions (not just common -- CONSTANT). In terms of breakability, I would rank Wordpress in the top 1% of applications without a second thought.
    - georgestephanis 12y ago
      If you believe you're aware of any security issues with WordPress core itself, Automattic is running a Bug Bounty program over on HackerOne here: https://hackerone.com/automattic/ https://hackerone.com/automattic/ -- responsible disclosure, bug bounties, and making the web a safer place is awesome.
      - nomedeplume 12y ago
        You really think some piddling Automattic bounty is more valuable than a WordPress 0day?!?!?!?!? (Conscious punctuation.) I'm at a loss for words, scaredy-cat.
        notfoss 12y ago
joshfraser 12y ago
Sorry about that. I tried to push the POC code to my blog and forgot that Heroku doesn't like the version of Wordpress I'm running. Should be back up now.

deleted 12y ago

[deleted]

fletchowns 12y ago

Why did it take months for Amazon to fix it?

joshfraser 12y ago
I have no idea. Adding a single HTTP header seems simple to me, but I have no idea what their architecture looks like. It took them an entire month to send me a "thanks, we're working on it" email and that was only after I followed up with them.
- mike-cardwell 12y ago
  They probably spent most of the time investigating to make sure that adding the header wasn't going to break anything.
  - joshfraser 12y ago
    Yep, they may have had widgets or legitimate framing that they needed to handle.
phil21 12y ago
Sounds about the right amount of time for a dev cycle in a large corporation. Yes, I may be a bit bitter...
- fletchowns 12y ago
  Yeah for a normal dev cycle. Security fixes do not need to follow a normal dev cycle.
greenyoda 12y ago
Probably because you can't do much by exploiting this security hole besides annoying people, so there's little incentive to do so. If you can get me to click on an item and buy it, the item will be shipped to my physical address, not yours. Even if was a product you were selling, I could return it for a refund and your account would be charged back. It doesn't seem like a very profitable scheme.

0h139 12y ago

Hope you got a bounty!

joshfraser 12y ago
Nope. Not even a t-shirt.
- mathattack 12y ago
  D'oh! I think you deserve at least a gift certificate!
- ohashi 12y ago
  That sucks. It makes responsible disclosure seem marginally less attractive without any type of reward. I am sure most people would either do it or not, but there's probably some on the fence. And some people might actually start looking knowing there was a legitimate reward.
  - DougBTX 12y ago
    There's a bit of back and forth between intrinsic and extrinsic motivation, where an external reward can reduce intrinsic motivation more than it increases extrinsic motivation. That is, if the reward is known but small, someone could go form, "I'll submit this since I want to help them out," to, "I'm not going to work for below minimum wage!" http://en.wikipedia.org/wiki/Motivation#Intrinsic_and_extrinsic_motivation http://en.wikipedia.org/wiki/Motivation#Intrinsic_and_extrin...
    - ohashi 12y ago
      So make it more than minimum wage. Problem solved.

jarrett 12y ago

Clickjacking is especially scary because most web apps are probably vulnerable. The default httpd.conf that ships with most package managers doesn't include the X-Frame-Options header. (Perhaps it should.) Based on my testing, it appears Rails does not add that header either. Do any other frameworks?

ludwigvan 12y ago
Django has a middleware: https://docs.djangoproject.com/en/dev/ref/clickjacking/ https://docs.djangoproject.com/en/dev/ref/clickjacking/ However, it is not turned on by default on old versions (<1.6) I believe, but latest versions should be fine: https://docs.djangoproject.com/en/dev/topics/http/middleware/#activating-middleware https://docs.djangoproject.com/en/dev/topics/http/middleware... .
garethadams 12y ago
Rails 4 includes that as a default header[1] and has done since August 2012[2] [1]: https://github.com/rails/rails/blob/master/guides/source/security.md#default-headers https://github.com/rails/rails/blob/master/guides/source/sec... [2]: https://github.com/rails/rails/commit/2a290f7f7cdf775491eda05b3690be6d96cd9bf6 https://github.com/rails/rails/commit/2a290f7f7cdf775491eda0...
- jarrett 12y ago
  It appears we're each partially right: If you generated a new Rails app after August 2012, you get the header by default. If you generated the app before August 2012, you do not get the header by default. So PSA: Updating Rails in an existing app does not cause this header to be added. You must add it yourself in application.rb if it's not already there. See garethadams' footnote #2 above.
homakov 12y ago
Most frameworks/servers don't do that. It's bad design of web specs, not a bug actually. Developers don't have to remember about it... And yeah, I added default_headers to Rails a while ago.

joev_ 12y ago

Unfortunately x-frame-options does not always fix these kinds of problems. If you can get the user to click more than once on your page, you can open a tab in the background on the first click (google for popunder.js), and if you can predict click #2 a split second before it happens (e.g. zalewski's game PoC), you can bring the popunder to the front and reposition it right under their cursor. (note: amazon could fix this by detecting when opener is xdomain and requiring some minimum number of mouseover events in the page before the button is clickable).

erikano 12y ago
>zalewski's game PoC I googled this but found nothing relevant. Do you have a link?
- joev_ 12y ago
  http://lcamtuf.coredump.cx/clickit/ http://lcamtuf.coredump.cx/clickit/
  - erikano 12y ago
    Thanks :)

micahgoulart 12y ago

> I resisted the temptation to use the exploit to send myself a million dollars worth of free Amazon gift cards Sorry, but that's not how Amazon's "Buy It Now" option works. It sends the item to the default address on file. So it would not be possible for the clickjacker to get it mailed to their own address.

joshfraser 12y ago
You can send a gift card to an email address that you specify. I can't seem to do it now, but I remember being able to pre-populate the email address using a GET variable: https://www.amazon.com/gp/product/B004LLIKVU/gcrnsts?ie=UTF8&qid=1402093716&ref_=sr_1_1&s=gift-cards&sr=1-1 https://www.amazon.com/gp/product/B004LLIKVU/gcrnsts?ie=UTF8...
giulianob 12y ago
Would it be possible to use this to sell items with you as a referral and get paid commission?
- joshfraser 12y ago
  Yes, but even better, you could list your own products on Amazon and get paid whatever amount you want. Of course, there's no way to stop the email receipts from Amazon, but you might be able to get away with it for short period of time.

euank 12y ago

I find it ironic that the wikipedia page on clickjacking [0] lists exactly this exploit as the example, and yet noone has reported it or fixed it in all this time. [0]: https://en.wikipedia.org/wiki/Clickjacking#Examples https://en.wikipedia.org/wiki/Clickjacking#Examples Edit: This example was added to the wiki page in December 2009. Relevant link: https://en.wikipedia.org/w/index.php?title=Clickjacking&oldid=334778176#Example https://en.wikipedia.org/w/index.php?title=Clickjacking&oldi...

joshfraser 12y ago
Wow, I hadn't even noticed that.
deleted 12y ago
[deleted]

homakov 12y ago

"Security hole" is a loud title. Is it worth a blog post at all? meh

joshfraser 12y ago
I'm a big fan of your research. I debated whether to go with a more specific title like "Clickjacking with one click purchases on Amazon" but decided to keep it simple for people unfamiliar with the concept.
- homakov 12y ago
  In fact it is a security issue but IMO you also should have emphasized: 1) amazon sucks at fixing bugs 2) clickjacking can be a serious issue

driverdan 12y ago

Simple solution: all browsers should have 3rd party cookies disabled, including iframes.

mappum 12y ago
If the fix was that easy, it would have been implemented by now. Doing so would prevent some useful behavior. For instance, an embeddable Facebook like button needs to run in an iframe and uses facebook.com cookies to be able to associate the like with the user.
- junto 12y ago
  Funnily enough, I would see that as a good thing rather than a bad thing!