this post was submitted on 05 Jul 2024
736 points (99.2% liked)

Technology

60083 readers
4481 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] kitnaht 150 points 5 months ago (3 children)

'hacked'. Eh. There was an API endpoint left open that allowed them to basically just spam it with no rate limiting. They used the lack of a rate limit to just pull the data out of the API that it was made to produce.

[–] just_another_person 175 points 5 months ago (4 children)

Yeah. They got data in a way that was not intended. That's a hack. It's not always about subverting something by clickity-clacking like in the movies.

[–] [email protected] 50 points 5 months ago (2 children)
[–] just_another_person 11 points 5 months ago (1 children)

Well...you son of a birch...now I'm in.

[–] [email protected] 1 points 5 months ago (1 children)
[–] just_another_person 0 points 5 months ago (1 children)
[–] [email protected] 1 points 5 months ago (1 children)

Understanding that's your reference, mine is that in Hackers they never said "I'm in" ;)

[–] [email protected] 1 points 5 months ago

What about Sneakers? Or maybe The Net?

If it’s not in those surely it must have been in NCIS a few dozen times.

[–] hemmes 1 points 5 months ago

You name it, we got it!

[–] kitnaht 30 points 5 months ago* (last edited 5 months ago) (4 children)

Exploit. The system worked as intended, just without a rate limit. A hack would be relying on a vulnerability in the software to make it not function as programmed.

It's the difference between finding a angle in a game world that causes your character to climb steeper than it should, vs rewriting memory locations to no-clip through everything. One causes the system to act in a way that it otherwise wouldn't (SQL injections, etc) -- the other, is using the system exactly as it was programmed.

Downloading videos from YouTube isn't "Hacking" YouTube. Even though it's using the API in a way it wasn't intended. Right-clicking a webpage and viewing the source code isn't hacking - even if the website you're looking at doesn't want you looking at the source.

[–] dezmd 15 points 5 months ago (2 children)

Exploiting is hacking, quit being pedantic.

[–] [email protected] 3 points 5 months ago

A system fault is not the same as a vulnerability. These would have different baseline CVSS 3.1 scores, with the temporal and environmental reducing over time. A medium/low at best for a public endpoint exposing PII.

[–] [email protected] 1 points 5 months ago

Hacking is the entire process including figuring out if something is or is not rare limited

[–] just_another_person -3 points 5 months ago (1 children)

Sure. Except you're wrong and have absolutely idea of what people in this community say about things. Let me be a dick and literally googz this for you and find an embarassing answer because you couldn't do it yourself.

[–] [email protected] 1 points 5 months ago (1 children)

So your googling proved him right. What's embarrassing about being right?

[–] Guest_User 1 points 5 months ago (1 children)

They gained unauthorized access. From that guys definition that is a hack, no an exploit

[–] [email protected] 4 points 5 months ago (1 children)

But they are using a loophole to gain sensitive data. They did not gain unauthorised access to the system.

[–] Guest_User 1 points 5 months ago (1 children)

They absolutely gained unauthorized access to the data. Their access was not intended or sanctioned. If it was intended to be public and accessible like it was, this wouldn't be a story and they wouldn't have locked down the access.

[–] [email protected] 1 points 5 months ago

But by the guy's definition, they also used a loophole to extract sensitive information, so it it also an exploit.

[–] [email protected] -3 points 5 months ago

A missing rate limit is a vulnerability, or a weakness, depending on the definition. You're playing smart without having an idea of what you're talking about. Here you go:

https://cwe.mitre.org/data/definitions/799.html

YouTube videos are public, and as such it's not really hacking. If you were able to download private videos, for example, it would be a vulnerability like "Improper Access Control". It does not matter in the least whether you use an "exploit" in your definition (which is wrong) or "just increment the video ID".

The result is a breach of confidentiality, and as such this is to be classified as a "hack".

[–] NateNate60 7 points 5 months ago (1 children)

With due respect, you are wrong.

hack

...

  1. (transitive, slang, computing) To hack into; to gain unauthorized access to (a computer system, e.g., a website, or network) by manipulating code

Hacking means gaining unauthorized access to a computer system by manipulating or exploiting its code.

Wiktionary

[–] just_another_person -3 points 5 months ago (1 children)

Exactly what this is. Read the disclosure. What about your response doesn't fit that?

[–] NateNate60 -1 points 5 months ago (2 children)

They did not do it by manipulating code. This wasn't the result of a code vulnerability. If you leave the door wide open with all your stuff out for the entire neighbourhood to see, you can't claim you were "broken into". Similarly, if you don't secure your endpoints, you can't claim you were "hacked".

[–] [email protected] 9 points 5 months ago (1 children)

Lack of rate limiting is a code vulnerability if we are talking about an API endpoint.

Not that discussion makes any sense at all...

Also, "not securing" doesn't mean much. Security is not a boolean. They probably have some controls, but they still have a gap in the lack of rate limiting.

[–] NateNate60 1 points 5 months ago (2 children)

It is a vulnerability, but exploiting that vulnerability is not generally considered by security experts to be "hacking" in the usual meaning of that term in academic settings. Using an open or exposed API, even one with a sign that says "don't abuse me", is generally not considered hacking.

[–] [email protected] 5 points 5 months ago (2 children)

I am a security professional. I would personally not care less to make the distinction, as both are very generic terms that are used very liberally in the industry.

So I don't see any reason not to call this hacking. This was not an intended feature. It was a gap, which has been used to perform things that the application writer did not intended (not in this form). If fits with the definition of hacking as far as I can tell. In any case, this is not an academic discussion, it is a security advisory or an article that talks about it.

[–] Freefall 1 points 5 months ago

I was gonna say, we use hacking as a term for a lot of things, even is something like cracking is more accurate. It is like Clip vs Mag in firearms...when you say clip EVERYONE knows what you are talking about.

[–] NateNate60 0 points 5 months ago

I'm not someone who works on the practical side of security, but as a computer scientist, I do not agree that it is "hacking". That contradicts my understanding of "hack" versus other types of exploits, but you are correct that the distinction is generally not that important. A security problem is a security problem regardless what it's called

[–] [email protected] 0 points 5 months ago (1 children)

Well from a professional here: It is.

[–] NateNate60 1 points 5 months ago (1 children)

I'm not talking out of my arse here either. I don't work in security specifically but I've got a CS degree as well and it contradicts my understanding of how those terms are generally used. This is an open API endpoint, equivalent to leaving the garage door open.

But the distinction is usually unimportant. A security hole is a security hole regardless of what you call it.

[–] lando55 1 points 5 months ago (1 children)

To build on you analogy: if you left your garage door open and people came in and started taking your things, is that not stealing?

[–] NateNate60 1 points 5 months ago (1 children)

Of course it's stealing. But they didn't break in.

Hacking = breaking in

Data breach = stealing stuff

[–] lando55 1 points 5 months ago (1 children)

What about this scenario:

  • you keep your main garage door, side doors, and windows locked
  • provide a key to anyone who wants to borrow your lawnmower or whatever
  • someone discovers a window you mistakenly left unlocked and starts using it to take stuff without using a key

Would this be considered breaking in? Probably. Here is where the analogy breaks down; if I were to leave the front door of my house unlocked, even if there's a welcome mat outside, anyone who enters without my knowledge or consent can be charged with breaking and entering (yes, even though no actual breaking is involved).

The interesting thing with public APIs is that there are generally terms and conditions associated with creating an account and acquiring a key, though if you are hitting an unauthenticated endpoint you technically never agreed to them. In this particular case with Authy, it would probably be argued that the intent was to acquire data by exploiting a vulnerability in the custodian's system and use it for nefarious purposes or profit. I'd call it a hack.

[–] NateNate60 1 points 5 months ago

The scenario you described would not be breaking in.

Terms and conditions being agreed to are not relevant for this purpose. An exposed API is one that is welcome to be exploited. If you're not requiring an API key, you're essentially saying "This API is free for anyone to use" for security purposes, regardless of what you say in the terms and conditions.

[–] just_another_person -5 points 5 months ago (1 children)
[–] NateNate60 6 points 5 months ago (1 children)

Please provide a link to whatever source claims this.

I hold a computer science degree and this contradicts the definition of "hack" versus "exploit" used in academic settings.

[–] irreticent -1 points 5 months ago

They probably typed it out themself then screenshotted it.

[–] NateNate60 1 points 5 months ago* (last edited 5 months ago) (1 children)
[–] kitnaht 0 points 5 months ago* (last edited 5 months ago) (3 children)

Hint -- by manipulating or exploiting its code

Which I am explaining, they...did...not...do...

They did nothing to the code. They didn't break the code, they didn't cause the code to do anything it wasn't designed to do. They did not exploit any code. They used an API endpoint that was in the open. For its intended purpose, to verify phone numbers. The api verified phone numbers, they verified phone numbers with the api. The only thing they did here...was they did verification on a lot of phone numbers.

[–] Guest_User 4 points 5 months ago

They absolutely exploited unintended functionality. If this was intended, they wouldn't have added rate limiting and locked down the api after. It was clear to say this was certainly not an intended use of the api.

In a video game for example, if there is a an item that caused excessive lagging just by placing the item. Placing a lot of them with the intent to lag the game would be an exploit. They only used items sanctioned by the game, but for unintended reasons and they would likely be banned for exploitation.

[–] [email protected] 2 points 5 months ago

You're arguing with someone who was agreeing with you 😑

[–] NateNate60 0 points 5 months ago

You are correct, I replied to the wrong comment

[–] Cornelius_Wangenheim 36 points 5 months ago* (last edited 5 months ago)

That's what most exploit-based hacks are. A developer makes a dumb mistake and then someone exploits it to do something they shouldn't be able to do.

[–] I_Clean_Here 4 points 5 months ago

This isn't about being pedantic but sure, mate.