Slashdot Mirror
Multiple Vulnerabilities Exposed In Pocket
vivaoporto writes: Clint Ruoho reports on gnu.gl blog the process of discovery, exploitation and reporting of multiple vulnerabilities in Pocket, the third party web-based service chosen by Mozilla (with some backslash) as the default way to save articles for future reading in Firefox. The vulnerabilities, exploitable by an attacker with only a browser, the Pocket mobile app and access to a server in Amazon EC2 costing 2 cents an hour, would give an attacker unrestricted root access to the server hosting the application.
The entry point was exploiting the service's main functionality itself — adding a server internal address in the "read it later" user list — to retrieve sensitive server information like the /etc/passwd file, its internal IP and the ssh private key needed to connect to it without a password. With this information it would be possible to SSH into the machine from another instance purchased in the same cloud service giving the security researcher unrestricted access. All the vulnerabilities were reported by the researcher to Pocket, and the disclosure was voluntarily delayed for 21 days from the initial report to allow Pocket time to remediate the issues identified. Pocket does not provide monetary compensation for any identified or possible vulnerability.
The entry point was exploiting the service's main functionality itself — adding a server internal address in the "read it later" user list — to retrieve sensitive server information like the /etc/passwd file, its internal IP and the ssh private key needed to connect to it without a password. With this information it would be possible to SSH into the machine from another instance purchased in the same cloud service giving the security researcher unrestricted access. All the vulnerabilities were reported by the researcher to Pocket, and the disclosure was voluntarily delayed for 21 days from the initial report to allow Pocket time to remediate the issues identified. Pocket does not provide monetary compensation for any identified or possible vulnerability.
There's a vulnerability in my jacket pocket too, it's called a 'hole'.
These seem like pretty basic things to get wrong.
Your hair look like poop, Bob! - Wanker.
Stop with the stupid integrated cloud services. It's a fucking web browser, if I want to use a web service I will GO THERE MYSELF.
Why is anyone still running Firefox? (Other than those of us who need to a keep a copy around for web dev.)
I'm really old-style. I bookmark the sites I regularly visit and that's it. I don't need this level of "continuity" (also referencing the Apple feature).
Maybe I don't miss what I don't know or maybe I don't care about what I miss. Besides, these days web sites are mostly story aggregators so there's probably not a whole lot of original content to miss.
Like all the other crap that's been added to our "browser", there should not be any default.
If you want to save a web page for later perusal on the same device, you can use Scrapbook Plus. It works. (If you want to install it on a recent browser and not an extended support release, scroll down and install from the development channel.)
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Am I missing something, or is there absolutely no point in this "Pocket" service? To save articles to read later? Isn't that what bookmarks are for? To save these across multiple computers? Chrome does that for me already... And I'm still not sure what they mean by making it readable offline later? Is it saving an entire copy of the article on the server? Wouldn't you still require ONLINE access to actually get these files or are they shadowed to your local device to?
If that's the case, there's this amazing "save as" option in most browsers, even "offline mode". None of these give anyone root access to anything. The thing is full of holes and apparently fills a niche for what, 1 guy too lazy to bookmark stuff? WTH
I don't get the point of this software at all. And I find it pretty insane that a system to merely let you save articles to read later would somehow gain root priv. What the heck is going on in the backend to allow that?
If an attacker can get a specially crafted "HAND" installed into pocket, the entire contents of pocket become exposed and can be taken unnoticed.
Pockets that are installed on "London Commuter" and "Paris Tourist" are particularly susceptible to HAND attacks
I'm getting to the point of just assuming that anything in the Cloud is insecure. That assumption makes security so much easier. There is no security.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Everybody knows forward slashes are the way to go.
The backlash has caused Mozilla to take a step back and re-evaluate things. But is it too little too late?
To me it looks as if Mozilla is in circle the wagons mode, being super defensive across the board. Constructively critical reviews about add-ons are being removed, apparently to keep the ratings in the 4 to 5 range for add-ons. Messages documenting problems are being removed in the support forums. (I saw one message that described a problem similar to the one I was having. When I went back to re-read it a day later, it had been removed.)
It looks like Mozilla has made its transition to a bloated corporation complete. They now appear to be in the "control the message" mode of operation.
Or are you just happy to see me?
Disable Hello, Pocket & Reader+, for your health
https://addons.mozilla.org/en-US/firefox/addon/disable-hello-pocket-reader/?src=api
http://harridanic.com
and use Chromium. It's 100% FLOSS (Firefox no longer is because of all the third-party binaries integrated therein), doesn't choke to death on memory leaks, and the default telemetry collection (spyware) is just as invasive as Firefox's.
How does one obtain the private key for root loging to a server in amazon ec2 cloud, if said private key is not stored on said server?
The word you're looking for is B-A-C-K-L-A-S-H. I think backslash is an alternate universe of Slashdot...
To Copy from One is Plagiarism; To Copy from Many is Research.
Is there something wrong with kwikset locks I should know about?
Poor tolerances allow a set of 243 keys to open any Smart Key lock.
A decoding tool was developed by Shane Lawson (Valanx) of the locksport group FOOLS.
Various low-skill, quick bypass and destructive entry techniques can be used against the Smart Key.
The Kwikset Classic locks (i.e. non-Smartkey) are even worse; like most ordinary pin-tumbler locks, they can be bumped open.
There were several in the version of Chrome the IT department installed.
The straw that broke the camel's back for me was the inability to remove a typo-squatting, not-safe-for-work, website address from the drop-down autocomplete suggestions in the address bar.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
regarding it's update schedules.
regarding its update schedules.
FTFY.
.
As many have said, it is insane to save things related to your personal interests on an anonymous server. Most of us have trilobytes of hard drive space available--so use it. Also, few web pages are worth saving due to the 30% devoted to content, 70% to obnoxious noise. So, some cleanup is desirable.
Here's what works on my Mac (YMMV): I find an interesting page that I haven't time to study right now so my first choice is to Copy the text and Paste it into a text editor. Perhaps there are pictures and charts that I want to include- I can copy & paste them too, but that's time consuming and some formatting is often lost.
The next option (brilliant, you'll agree) is to turn on the Add-On called HackTheWeb. Oooh, you're gonna like it. So now I can select elements of the page to Remove or maybe a central article to Isolate. On a very complex page it can be tricky to get just what you want without all the cruft. Get rid of the ads, doodads and other junk leaving a nice clean article to save.
Finally, with the Mac I go to the Print menu and verify that it looks like I expect, and then I Print to PDF. I have a clean copy ON MY DRIVE, and not some foreign server. The entire process takes 1-3 minutes but it results in an easy to read page that can be proudly shared with other interested parties.
...omphaloskepsis often...
If I understand this disclosure correctly, the SSL/TLS Private Key could be read by anyone aware of the vulnerability and could figure out the location of the private key (or location of the configuration specifying the location of the private key). Should Pocket really still be using the same certificate from April 2015?!