Slashdot Mirror
Hacker Finds Bug to Edit or Delete Any Medium Post (vice.com)
Joseph Cox, reporting for Motherboard: Medium has become the go-to home for extended blog posts from researchers, CEOs, and even the President of the United States. Now, one hacker has found a way to edit or delete any post on the publishing platform. "I tried to think of different possibilities or testing cases on how can I delete a story of any user. And fortunately, I found a severe bug," Philippines-based freelance penetration test and bug bounty hunter Allan Jay Dumanhug told Motherboard in an email. The trick, Dumanhug explained in a blog post published at the end of last month, centres around Medium's "Publications" feature. Users can create their own publications -- perhaps a page dedicated to infosec news, for example -- and then request to add other users' posts to it. Each post on Medium is given its own unique, 12-character identifier code. The person who authored the post has to approve that request, otherwise their story doesn't go anywhere. But Dumanhug found that while adding his own story to his own publication, he could intercept the HTTP request and simply change the identifier to that of another post.
First clue was the puffery in the lede.
clearly the name Medium refers to their level of security.
For a moment there, I thought he'd found a way to delete a post from any medium. That would have been a whole lot worse.
Ta-da! Now people know that Medium exists.
This sounds like story about the guy who rm -rf'd his whole webfarm.
So far I've been fairly pleased with reading things on Medium, although some of the weird sliding underlay pics I can do without. So when will the nice experience give way to a horrible one? When they force ads on those who run ad blockers? When they decide they aren't making enough money from the site as is? Micro transactions? So far it's been almost too good to be true.... which makes me deeply suspicious.
Horror & SciFi Erotic Nudes
news at eleven
It's interesting how ESPM bought PornHub with their pyramid scheem, and make porn videos with montage using children wering the same clothes of the actresses. Many videos are montages with adults, but the closeups are often children. I know that because I knowpussy, and not the same pussy when the view changes.
If a white-hat hacker had found this exploit, he would've gone ahead and deleted all Medium posts. And there would have been much rejoicing.
captcha: scrotum. wtf?
and even the President of the United States
How does he get a "even"? He is a paid employee of the people of America. He listens to what spies and Jew lobbyists tell him to do because he is afraid hey will kill he scrawny black ass. He is guilty of treason. He destroyed American healthcare with the "Affordable Care Act" AKA Obamacare. He lets jobless destitute immigrants flood the borders to drink at the trough of taxpayer's social services, meanwhile the country is living on a dead fiat currency. He is just a fucking lawyer being told what to do by spies with pistols and suppressors. People voted for him, but only the ones stupid enough to think their vote would count. It is an electoral college system. Can you even find the electoral college representatives list online RIGHT NOW for this election? No, you can not.
All of this shit is spread to people young and old over Jewish media. They are friends of a country living under a rocket-force-field who lie. This is why they live under the Iron Dome. Nobody likes a liar. So it should have said...
and even the lying treasonous cocksucker the President of the United States
Any real mediums would see the deletion coming....
That's not a bug. It's just a total lack of authentication. No put in the effort, because no one cared. Congrats. This ain't a surprise.
Perhaps a blogging platform needn't the same level of security as a bank or nuclear power centre.
A lesson for young programmers: if you're going to divulge your UIDs (or make them easily guessable, like sequential), be sure to pair them with a random string before you accept them from an outside source -- like user input.
"he could intercept the HTTP request and simply change the identifier to that of another post."
Stand back guys, we got a pro here.
Medium has become the go-to home for extended blog posts from researchers, CEOs, and even the President of the United States.
That explains why I haven't found a single thing on that site worth reading. I guess it's not cold enough outside to enjoy that much hot air.
to delete all posts on medium, right?
I mean basically half the articles are shills for products, and the other half tend to be half-baked opinion pieces by smug, "I've been programming for less than a year, but I'm an expert" pieces.
It's the new Tripod or Geocities... which ironically could be exploited by a similar method
It's a rare Medium that's done well.
His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain
Rule 1. Never trust any user input.
Rule 2. Using encrypted checksums and other input checking to verify the contents of system generated forms before accepting them is a good thing.
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
I expect the hacker was a disgruntled Slashdot reader who had to put up with one too many StartsWithABang posts. I'm awaiting news that Forbes is has been hacked next.
I hear they are high tech. They even have Unicode support.
I replied to the wrong comment.