Hacking Web Services

siduri writes "Udi Manber, chief scientist at Yahoo!, gave a great talk on the kinds of hacks that Yahoo sees at the IEEE's Symposium on Security and Privacy. I wrote an overview of his talk for Dr. Dobb's Journal. While some of the message is well-known stuff (like that people will spend a lot of time hacking the most trivial things), the details of what Yahoo has to deal with are really pretty interesting."

Comments

Google Hackers

[taya0001]

I know that someone has been hacking google for the past few years about once a week. Always changing the google logo(jk). I guess google is just powerless to protect themselves

Access To Manber's Paper...And More

[cybrpnk2]

The IEEE Symposium on Security and Privacy is one of the longest-running forums on this topic and is well worth being aware of. The papers for the 2002 session are on CD-ROM; so is a compilation of those from 1980-1999...

Ah, the Irony!

[MidKnight]

Interestingly enough, by copy-and-pasting the whole text of this story from Dr. Dobbs to Slashdot, you have unwittingly done one of the more common "hacks" that Udi Manber describes as being dangerous. Information stealing is easy to do, and sometimes doesn't even feel like it's a crime.

Congratulations for illustrating his points so directly.

--Mid

Yahoo's problems...

[Jace of Fuse!]

Yahoo's problems are massive, and I think it's good that at least SOME people at Yahoo realize it, even though I'm still not convinced they are aware of the full scale of the problem.

After all, if you chat with Yahoo's service, you're eventually going to be booted off by another user. Some of the methods users use to exploit the system and kick off other users are clever, some are not so clever.

One method involves running a program easily downloaded off of the internet and typing in the desired victims name. It's your basic "Punter". Some of the programs available are effective at removing users of Yahoo's Messenger, while a few of the more recent ones do a good job taking out users who use 3rd party Yahoo clients, or even Yahoo's web-based Java client.

These methods of exploitation are half-way understandable, though I don't see why Yahoo hasn't worked to block the attacks in the same way that AOL has with AIM.

The other method, plain old boot-text, is simply unacceptable.

If I were chatting with someone using Yahoo Messenger and they annoyed me, all I would have to do is send them a single URL with an unrealistically long domain name in it, and their Yahoo Messenger will crash. A URL such as www.xxxxx.com with about 400 to 500 X's in the name will work nicely.

It's a relatively simple matter for the end user to set up a personal word-filter on their messenger and block out all occurences of "www." which effectively makes them invulnerable to this attack, but that is not the issue. The issue is, that if Yahoo has such easily exploitable end-user software, I'm very worried about the quality of their security as a whole.

Think about it.

Re:Full Text

[bafu]

If anonymity disappeared from the web, "a lot of the problems would go away," he said.

That's especially true if you equate users with problems ;-)

But he dismissed legal solutions altogether, saying that measures like anti-spam legislation are completely ineffective. "This has to be solved technically, not legally," he warned. "If we can't solve these problems, we'll see less and less services."

That's a point that is occasionally debated in anti-spam circles. The problem there is that the Internet mail delivery system was designed for the kinds of users we had 25 years ago. Heck, it wasn't until somewhat over 5 years ago that all the MTAs [that mattered] would ship with relaying turned off by default. Looked at from that perspective, it seems like a technical problem... change the delivery system and you make the abuse irrelevant. The problem is, how do you implement such a change? It's not so much a question of designing a new system... I've seen a number of proposals that looked fine. The problem is, how do you get all the mail servers on the net to switch over?

At that point in the debate is where the division usually comes in. Some folks will propose various systems for gradual adoption of new systems (essentially having two delivery systems in place until the new one is widely adopted enough to drop the old), while others pull back at that point. They'll say that spam is a social problem and, as a result, it can't be solved technically. Usually those folks will go on to pursue legislative attempts at a solution. The problem is, the track record of using legislation to solve social problems is nothing to write home about.

If he can come up with a technical solution for Yahoo!, of course, then he is all set. The problem, as he said, was that you only have so much identification information available to you at the server end. That makes it nontrivial to reliably separate the valid users from the rest. The thing is, just how much personal identification information are you comfortable giving to Yahoo! to get a mailbox...?

Re:i am a penny-stealer

[mborland]

now, i understand they are talking about thieves, on the whole, but it seems easy enough to track massive hits from another server and then to block it. i mean, it's 2002. let's fix these problems.

Often, it's not a matter of restricting access. The description of the E-Bay situation where other people would generate bad logins as a competitor to lock them out is a good example. You need to provide this functionality, to keep from having your client's accounts broken into. Yet, that very policy can be used effectively as a denial of service against your clients.

I run into sysadmins who assume that issues are binary--something is bad, cut it off; something is good, allow it. Usually more complex applications require much more of an understanding of a balance between business functionality and security. In the case of E-Bay and user lockout, there is no exact solution--you need to satisfy two opposing interests--so you make a compromise between the two and try to forge a workable solution.

I think the biggest challenge for the security community will be how to modify their practices (and others') to be able to quantify risk in applications so that businesses can make good functional decisions. Security teams have largely focused on perimeter security and things like web parameter checking, but they don't usually stray into the gray area of functional requirements--or if they do, usually only to, as some have put it, cut the wings off flies.

So, to get back to the original point of the post--it's not so easy to solve as just blocking traffic. Nope, sorry, it's a lot more work than that.

Re:The guy sounds like a world-class sleazeball.

[First Person]

he talked about countermeasures instituted against hackers, but doesn't want them openly published (security through obscurity, anyone?)

I'm quite tired of hearing statements like 'company X won't reveal Y; this demonstrates security though obscurity which everyone knows is bad.' Well, it's not! Your statement demonstates that you can echo the slogans but don't understand what security really means. I strongly encourage you to read a recent Crypto-gram by Bruce Schneier. You cannot apply the principles used for analyzing a mathematical system to all real world security issues.

The last quote interests me...

[rhadamanthus]

But he dismissed legal solutions altogether, saying that measures like anti-spam legislation are completely ineffective. "This has to be solved technically, not legally," he warned. "If we can't solve these problems, we'll see less and less services."

I am unsure if here he is saying that anti-spam legislation will be ineffective, or if the "right to spam" should not be outlawed by lawmakers. I would imagine the former is what he meant, since obviously, having the U.S. outlaw spam will do nothing to stop spammers in other countries, and probably do little to stop spammers here in the states either....

Solving the spam problem technically seems to be impossible though. People have been trying to do that forever. I find it very poignant that in the same passage he says that spam could kill off services if it continues to be unstoppable.

---------------rhad

Re:The last quote interests me...

[ChaosDiscordSimple]

Solving the spam problem technically seems to be impossible though. People have been trying to do that forever.

The solution exists, it's just that the transition to the solution will be painful, so we're desperately trying to avoid it.

The solution is whitelists and "postage".

Put all your friends in a whitelist. Main from them is delivered instantly.

Anyone else who emails you gets an autoreponse, "I don't know you. To ensure that you're a real human being, you'll to need to run the postage program to get the result for the code ABAASDFFEFEF". The program needs to be open source and easily verifyable for security reasons. The program solves some problems that is hard to compute (say 60 seconds), but easy to verify. One example would be a brute for cypher break on a simple cypher. The senders email client can handle this autoreponse automatically, shielding the sender from needing to deal with it (Gee, my computer gets slow for a bit when I email someone new). Spammers, on the other hand, would need to either limit their spamming so they have time to generate valid responses, or would need to invest in expensive hardware to generate the responses fast enough. End result: It's no longer cheap and easy spam.

There are a few other details to make mailing lists feasible, but it's doable.

However, this effort would require everyone to upgrade their mail clients or to use external programs to manage this. Given that extremely slow adaptation of other email security features, I'm not optimistic.[B

maybe the problem is the business model?

[g4dget]

But he dismissed legal solutions altogether, saying that measures like anti-spam legislation are completely ineffective. "This has to be solved technically, not legally," he warned. "If we can't solve these problems, we'll see less and less services."

Yahoo!'s problems are no different from those brick-and-mortar retailers have with loss leaders and promotions: if you give something away at a loss, there is a good chance that others will find it profitable to get lots of it and resell it. It's not a security problem, it's a problem with the business model. Welcome to the real world.

Yahoo! may want to continue to bask in the glory of having many millions of users, but if they want stop these problems, all they have to do is charge for all of their services. The choice is really theirs.

Don't get me wrong: I like Yahoo! services and I think it would be great if they continue to be free. But I really worry when Manber uses terms like "theft" and "security" for a problem that has very little to do with "theft" and "security". Fortunately, Manber himself isn't calling for a legal solution, but management and lawmakers may be less understanding of the issues involved.

Lockout of accounts...

[slykens]

From the article:

During hotly contested auctions, some users will mount password attacks on other bidder's accounts an hour before the end of the auction -- not to actually gain access, but merely to trigger a security lockout, thereby ensuring that the legitimate user cannot place last-minute bids.

I realize how ridiculously easy it is to get a new IP address on a dialup system or in a facility where someone has access to many addresses but wouldn't a simple IP block after so many attempts help discourage the casual DoS but still allow the legitimate user access when they come to make their last minute bid?

If not this then what about using a login name which is different then the displayed account name? This way the login name is not available to people viewing a particular account's public details for their use in a DoS. I know this is an added step of complication but may be necessary to eliminate bad side effects.

Re:Lockout of accounts...

[wdr1]

I realize how ridiculously easy it is to get a new IP address on a dialup system or in a facility where someone has access to many addresses but wouldn't a simple IP block after so many attempts help discourage the casual DoS but still allow the legitimate user access when they come to make their last minute bid?

There are a lot of solutions that seem great at first, but encounter difficulties once you try to execute them. In this instance, you're totally forgetting about a couple of factors.

1) Scalability - how do keep this IP list? How do you search it quickly? How do store the data? Expire it? Compute your run time for values of N > 100,000,000. Does it still work?

2) Proxy servers & routers/ip masquerading. While a lot of slashdotter's don't live behind them, a lot of Internet users, including those using very popular providers, such as AOL, do. If you block based upon IP, you still allow AOL users to block one other. A step up from nothing, perhaps, but far from a complete solution.

There's probably more, but those are two off the top of my head.

-Bill

Reverse authentication

[Erasmus Darwin]

It's a shame his reverse authentication idea will never take off. I've actually wished there were something already available along these lines. As it currently stands, email addresses are a dime a dozen, IP addresses can change every few minutes (for dialup and DSL users, at least), and proxies allow a user to avoid even a broad IP range block.

So it would be a great boon to web services if there were a way to somehow have a way of confirming that a person hasn't already signed up for a service. It'd allow many boards to weed-out their troll population while maintaining an open sign-up. On one forum I was on, the problem was so bad that registration was completely closed then later moved to a pay-only model.

The problem is that I can't see any way to do it without compromising the identities of the people. For example, I don't see a problem with Slashdot knowing that 'Erasmus Darwin' is my only Slashdot account, but I don't want to create a system where they could theoretically share records with another entity and use that to determine my identity there. Perhaps the identity token I provide to Slashdot could be some sort of one-way hash of my identity combined with '@slashdot.org', thereby limiting it to a single area.

One downside of this system is that a government-type institution with a search warrant could use my secret identity information to reproduce my Slashdot token and verify my identity. I don't see any way to prevent the identification from somehow serving to find-out who I am. Still, that theoretically pushes the identification process off to a similar level of difficulty to tracing the user's IP (i.e. Slashdot couldn't do it on its own). Thus, if we pretend that no one uses anonymizing web proxies, it's the same level of anonymity.

Also, there'd be a problem of issuing the secret identity keys. Presumably, this would be handled by the companies that already do encryption/security certificates. That means there'd be a cost associated with such keys, which would turn away a number of people. If only a small percentage of people fork over the $XX/year for a personal identity certificate, most sites won't be able to require their use for signup. Furthermore, it'd be difficult for the issuing agency to verify the uniqueness of each request, especially when we consider that this would have an international audience. I also wouldn't be surprised if some of the countries that have whored out their ccTLDs decided to also start selling their equivilent of SSNs to people interested in extra identities.

Finally, there'd be the issue of identity theft. Having a single, computer-based identity key would be a very tempting target for various malicious programs. If I were an evil spammer type and such an identity system were in place, I'd definitely try and steal as many identities as possible for sign up use.

Re:i am a penny-stealer

[Fulcrum of Evil]

In the case of E-Bay and user lockout, there is no exact solution

In this case, a lockout that is specific to remote address or address block might be useful. Add in some checks for stuff like AOL (different IP each connect and a pile of users) and dialup blocks (lockout a class C network for that login to frustrate redial attempts) and keep stats on where a user comes from (repeated attempts from a commonly used net block may be treated more leniently and trigger an email to the user's registered address, whereas an unusual address generates a longer lockout and no email to the user).

Re:Sleezy Yahoo Business Practices

[Anonymous Coward]

Your claims are pretty slanderous, and you don't have much to back them up.

For one, it looks like Yahoo did not even implement their own system. If you look right below the word prompt, you can see they're basically using Captcha developed at Carnegie Mellon.

Are you saying CMU stole for you as well?

Is it possible that others came up with similar, if not better, systems, and they used them instead?