Foursquare iPhone app sends passwords in plain text, don't use

#1

Post by bitanarch » Sat, Aug 21, 2010, 7:36 PM UTC

Did a Wireshark session vs. Foursquare for iPhone's traffic after reading the news today. Found something very unpleasant.

Foursquare iPhone app sends passwords in plain text, don't use
martinkou.blogspot.com

Re: Foursquare iPhone app sends passwords in plain text, don't use

#2

Post by tetrisgm » Sat, Aug 21, 2010, 8:39 PM UTC

Have you double checked? Seems weird, especially for a mobile checkin app that is much more likely to encourage using open wlans :/

Re: Foursquare iPhone app sends passwords in plain text, don't use

#3

Post by phjohnst » Sat, Aug 21, 2010, 9:15 PM UTC

tetrisgm wrote: post #2

Have you double checked? Seems weird, especially for a mobile checkin app that is much more likely to encourage using open wlans :/

Yeah, I have a hard time believing that this is accurate. Definitely scary if true, but I would like to put my faith in Foursquare having checked this box a long time ago.

Also: why, after millions of checkins over public networks, is this only coming up now? Surely someone would have got burned by this by now?

Re: Foursquare iPhone app sends passwords in plain text, don't use

#4

Post by EricButler » Sat, Aug 21, 2010, 9:17 PM UTC

Foursquare doesn't support SSL at all. The best you can do is request a long-lived OAuth token, but even doing that requires sending the user's email/password in plaintext (although only once!).

Re: Foursquare iPhone app sends passwords in plain text, don't use

#5

Post by bitanarch » Sat, Aug 21, 2010, 9:18 PM UTC

Double, and triple checked. You can reproduce this yourself. I'm using a MacBook Pro for this.

1. Plug your MBP to wired ethernet - you have one of these in your home, right?

2. Open an ad-hoc network in your MBP, and share Internet access via that ad-hoc network.

3. Connect your iPhone to your MBP's ad-hoc network, now it should be able to access the Internet via your MBP.

4. Install and fire up Wireshark in your MBP - make sure to read the instructions or otherwise it can't capture packets.

5. Get Wireshark to capture packets on the ad-hoc Wifi interface.

6. Filter out the HTTP packets going to *.foursquare.com by adding the filter 'http.host contains "foursquare"'

7. Fire up Foursquare on your iPhone, login if you haven't already

8. Boom, you've just sent your password in plain text, over the Internet.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#6

Post by kidsat » Sat, Aug 21, 2010, 9:29 PM UTC

tetrisgm wrote: post #2

Have you double checked? Seems weird, especially for a mobile checkin app that is much more likely to encourage using open wlans :/

HTTP port 80 traffic from Android app:

  GET /v1/checkins?geolat=34.2842613&geolong=-118.2471837&geohacc=112.0 HTTP/1.1
  User-Agent: com.joelapenna.foursquared:2010080500
  Host: api.foursquare.com
  Connection: Keep-Alive
  Authorization: Basic dXNlckBleGFtcGxlLmNvbTpwYXNzd29yZA==

HTTP port 80 traffic from iPhone app:

  POST /v1/checkin.json HTTP/1.1
  Host: api.foursquare.com
  User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_2 like Mac OS X; en-us)
  Content-Type: application/x-www-form-urlencoded
  Authorization: Basic dXNlckBleGFtcGxlLmNvbTpwYXNzd29yZA==
  Accept-Encoding: gzip
  Accept: */*
  Accept-Language: en-us
  Content-Length: 250
  Connection: keep-alive

Re: Foursquare iPhone app sends passwords in plain text, don't use

#7

Post by desigooner » Sat, Aug 21, 2010, 9:31 PM UTC

phjohnst wrote: post #3

tetrisgm wrote: post #2

Have you double checked? Seems weird, especially for a mobile checkin app that is much more likely to encourage using open wlans :/

Yeah, I have a hard time believing that this is accurate. Definitely scary if true, but I would like to put my faith in Foursquare having checked this box a long time ago. Also: why, after millions of checkins over public networks, is this only coming up now? Surely someone would have got burned by this by now?

>>Also: why, after millions of checkins over public networks, is this only coming up now? Surely someone would have got burned by this by now?

maybe because people usually check in over the Cellular data network and not wireless networks. I guess it'll be the same if there was a way to sniff out cellular data. Simple oversight or absence of a security mindset in app development.

I think one of the other geo-social-apps mandated checkins over WiFi (Loopt star i believe) .. It'll be interesting to see if they have the same flaw. In that case, it actually might be a bigger threat as the only way to send over information is over the wi-fi network.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#8

Post by jsz0 » Sat, Aug 21, 2010, 9:38 PM UTC

phjohnst wrote: post #3

tetrisgm wrote: post #2

Have you double checked? Seems weird, especially for a mobile checkin app that is much more likely to encourage using open wlans :/

Yeah, I have a hard time believing that this is accurate. Definitely scary if true, but I would like to put my faith in Foursquare having checked this box a long time ago. Also: why, after millions of checkins over public networks, is this only coming up now? Surely someone would have got burned by this by now?

Probably just because it's not very practical and there is no obvious payoff. You would have to sit around a popular spot for hours with a laptop sniffing the wifi to collect logins. What do you do with them? For SPAM purposes it would be easier to just make new accounts. As far as I know there's not a whole lot of valuable information in a FourSquare account like credit card numbers or banking information. Seems like the only thing you could really do is embarrass people.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#9

Post by desigooner » Sat, Aug 21, 2010, 9:41 PM UTC

jsz0 wrote: post #8

phjohnst wrote: post #3

Earlier quoted context omitted.

Yeah, I have a hard time believing that this is accurate. Definitely scary if true, but I would like to put my faith in Foursquare having checked this box a long time ago. Also: why, after millions of checkins over public networks, is this only coming up now? Surely someone would have got burned by this by now?

Probably just because it's not very practical and there is no obvious payoff. You would have to sit around a popular spot for hours with a laptop sniffing the wifi to collect logins. What do you do with them? For SPAM purposes it would be easier to just make new accounts. As far as I know there's not a whole lot of valuable information in a FourSquare account like credit card numbers or banking information. Seems lik…

True that there is no obvious threat to having access to someone's foursquare account and the worst that could happen to someone is checkins at random joints that could lead to embarrassment for some (viz. strip joints, certain clubs and so on).

However, unfortunately, there are people out there who will probably have the same password for their Facebook/Twitter accounts and even email accounts. Those are the people at threat here.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#10

Post by bitanarch » Sat, Aug 21, 2010, 9:41 PM UTC

jsz0 wrote: post #8

phjohnst wrote: post #3

Earlier quoted context omitted.

Yeah, I have a hard time believing that this is accurate. Definitely scary if true, but I would like to put my faith in Foursquare having checked this box a long time ago. Also: why, after millions of checkins over public networks, is this only coming up now? Surely someone would have got burned by this by now?

Probably just because it's not very practical and there is no obvious payoff. You would have to sit around a popular spot for hours with a laptop sniffing the wifi to collect logins. What do you do with them? For SPAM purposes it would be easier to just make new accounts. As far as I know there's not a whole lot of valuable information in a FourSquare account like credit card numbers or banking information. Seems lik…

A lot of people use the same passwords for GMail, bank, credit card, Facebook, ..., and Foursquare. So it's a big deal if you can easily collect passwords from any one of these services.