Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I recorded user behaviour on my competitor’s websites

dejanseo.com.au

Post reply on HN
Print view View original

151–160 of 329 posts

Re: How I recorded user behaviour on my competitor’s websites

#151

Post by 3eto »

TekMol wrote: post #58
dejanseo wrote: post #54

Hi everyone! I did this. It was just a random cool idea I wanted to try. It worked a little too well and I quickly moved it to a disposable site to test if the page will get penalised by Google. I got busy with other things and forgot about it. When I bumped into it again I decided to write about it, for two reasons: 1) To me it's hard to believe that Chrome would allow for this to happen in the first place and 2) th…

Copying someone elses site and tricking their users to use your copy is a copyright violation and fraud. Nothing cool about it.

What's not cool at all is the fact exposed here that Google lets anyone trick their users.

Re: How I recorded user behaviour on my competitor’s websites

#152

Post by eadmund »

shawn wrote: post #149
superasn wrote: post #142

Earlier quoted context omitted.

It's sad that everyone is being so harsh to you just because you decided to post about a vulnerability that who knows thousands of other people are quietly exploiting for their own benefit. If anything I am happy that instead of trying to misuse it or keeping it a secret you made it public knowledge so that there can be something done about it. Yes you could have handled it more appropriately and you probably will in…

Howdy, former Matasano pentester here. FWIW, I would probably have done something similar to them before I'd worked in the security industry. It's an easy mistake to make, because it's one you make by default: intellectual curiosity doesn't absolve you from legal judgement, and people on the internet tend to flip out if you do something illegal and say anything but "You're right, I was mistaken. I've learned my lesso…

> So to be clear, the crux of the issue was running the exploit on a live site without their blessing.

Well, he wasn't running it on someone else's site, right? All the code ran on his site, so at worst he was guilty of trademark infringement or — if he copy-pasted HTML or rendered the same text — copyright infringement (which he could have avoided by just being a proxy to them, I think).

Or did I miss something? It doesn't sound like he did anything to other sites themselves.

Re: How I recorded user behaviour on my competitor’s websites

#153

Post by tralarpa »

dvfjsdhgfv wrote: post #143
tralarpa wrote: post #113

Earlier quoted context omitted.

> you're likely to cross the line sooner or later. That's basically the opposite of what security researchers working for companies and research institutes are doing. Document everything, get written consent of involved parties and sometimes even inform the police about a planned action. Make sure that you (a) don't cross the line or (b) move the line legally further away. Of course, there are security experts who do…

I'd argue the most interesting and important research is done in this way. It's not that these security experts "don't care", it's just the very nature of certain problems that you need to test them against real users (as opposed to, say, testing an exploit against a system). Consider, for example, honeypot research the very nature of such scenarios is that you can't even hint that users are tracked, let alone asking…

The legal aspects of honeypots were discussed a lot when they became popular. Just two examples:

https://www.symantec.com/connect/articles/honeypots-are-they...

https://www.researchgate.net/profile/William_Yurcik/publicat...

And they are still discussed, for example in the light of the new EU laws:

https://jis-eurasipjournals.springeropen.com/articles/10.118...

Re: How I recorded user behaviour on my competitor’s websites

#154

Post by baddox »

joesb wrote: post #141
dorgo wrote: post #130

Earlier quoted context omitted.

Maybe restrict the history API to the same-origin-policy? Javascript could/should be allowed to manipulate browser-history only for the same domain. Just an idea.

It just change `windown.location`. And it would be very limited if JS can't change `window.location` to outside its current domain.

This exploit uses the history API, which allows JavaScript to change the URL in the browser URL bar to another URL with the same origin without actually causing a new full page request. The same-origin policy has always been in place, because it would obviously be a huge vulnerability to allow any web page to pretend to be a different website.

Changing window.location is different: it allows you to change the browser URL bar to any URL (including google.com, etc.), but it actually causes the browser to do a normal page load of the new URL, just like if the user had clicked a link to the new URL. Thus there is no spoofing vulnerability exposed by the window.location feature.

Re: How I recorded user behaviour on my competitor’s websites

#155

Post by tralarpa »

dvfjsdhgfv wrote: post #143
tralarpa wrote: post #113

Earlier quoted context omitted.

> you're likely to cross the line sooner or later. That's basically the opposite of what security researchers working for companies and research institutes are doing. Document everything, get written consent of involved parties and sometimes even inform the police about a planned action. Make sure that you (a) don't cross the line or (b) move the line legally further away. Of course, there are security experts who do…

I'd argue the most interesting and important research is done in this way. It's not that these security experts "don't care", it's just the very nature of certain problems that you need to test them against real users (as opposed to, say, testing an exploit against a system). Consider, for example, honeypot research the very nature of such scenarios is that you can't even hint that users are tracked, let alone asking…

> I'd argue the most interesting and important research is done in this way

Links please :)

Re: How I recorded user behaviour on my competitor’s websites

#156

Post by adrianN »

King-Aaron wrote: post #103
mrob wrote: post #4

Earlier quoted context omitted.

Yet another reason to browse with JS disabled by default.

That's a reasonable course of action until you need to use the internet for pretty much anything .

Works pretty well for me.

Re: How I recorded user behaviour on my competitor’s websites

#157

Post by eadmund »

King-Aaron wrote: post #103
mrob wrote: post #4

Earlier quoted context omitted.

Yet another reason to browse with JS disabled by default.

That's a reasonable course of action until you need to use the internet for pretty much anything .

The Internet works just fine without JavaScript: DNS, FTP, SSH, SMTP, NNTP — none of them have ever required JavaScript. Indeed, HTTP works just fine without JavaScript. HTTP pages perform better without it.

Granted, many broken and ill-programmed HTTP pages aren't useful without JavaScript. That's no an indication of how useful it is, but rather an indication of how poorly-skilled those webmasters are.

Then there are web apps; they indeed don't work properly without JavaScript. Fortunately, there just aren't that many important web apps. To be honest, I can't think of one web app that I regularly use, other than Google Meet.

Re: How I recorded user behaviour on my competitor’s websites

#158

Post by loriverkutya »

dejanseo wrote: post #76
tnolet wrote: post #65

Earlier quoted context omitted.

Yay, you misled users and stole content! Seems like you are actually proud of this. I gather you realize this and did this in the best “white hat” spirit, although that’s not really what I get from your blog.

Where did I say I'm proud of this? Everyone keeps saying "proud". I chose to share it in public because it's a serious problem that others may be using it to do real harm. I blog about many things, most harmless and often very useful. I remember one other time when I exposed something broken in Google. I got penalised as a reward.

> I chose to share it in public because it's a serious problem that others may be using it to do real harm.

There is a process called responsible disclosure, next time when you find a serious problem, you probably try to follow that.

Also google has a Vulnerability Reward Program, so if you report you findings directly to google, you can even get money as a reward.

Re: How I recorded user behaviour on my competitor’s websites

#159

Post by GedByrne »

I’d like to defend this guy. What he is doing is testing the trust mechanism.

If he went to Google and said ‘I think the trust mechanism is broken’ Google would say: ‘We know, that’s why we are pushing to move everyone to https.’

‘That isn’t enough. The padlock on the https page gives users a false sense of security.’

‘We don’t agree with that. Where’s your data?’

Google wouldn’t have accepted this. They have pushed full HTTPS hard, and suggesting that it has a negative consequence is unacceptable to them.

His experiment has proven the problem. How else could it have been demonstrated?

Ideally this would have been a large scale study done by academics. But this guy doesn’t have those resources. Nobody is going to fund this research.

The depressing thing here is that everybody is more interested in calling this guy a jerk than dealing with the issues he has raised.

Trust on the internet is broken. This guy did it with ease. Imagine what is being done by those who want to scam millions?

But yeh, call him a jerk and then you can bury your unease beneath a big pile of outrage. It’s fine. Fine. He’s a jerk.

Re: How I recorded user behaviour on my competitor’s websites

#160

Post by shawn »

eadmund wrote: post #152
shawn wrote: post #149

Earlier quoted context omitted.

Howdy, former Matasano pentester here. FWIW, I would probably have done something similar to them before I'd worked in the security industry. It's an easy mistake to make, because it's one you make by default: intellectual curiosity doesn't absolve you from legal judgement, and people on the internet tend to flip out if you do something illegal and say anything but "You're right, I was mistaken. I've learned my lesso…

> So to be clear, the crux of the issue was running the exploit on a live site without their blessing. Well, he wasn't running it on someone else's site, right? All the code ran on his site, so at worst he was guilty of trademark infringement or — if he copy-pasted HTML or rendered the same text — copyright infringement (which he could have avoided by just being a proxy to them, I think). Or did I miss something? It…

Ah, you’re right of course. I should have been more clear.

To the author: an alternate ending to this story could have been “competitor found out; flipped out; forwarded this to their legal department; your next two years are very unpleasant, even if the lawsuit ends up settled.”

That’s the main reason why you want to get permission and make everyone aware before doing this.

Here’s a small example: at Mtso a coworker had been running a netpen against a certain well known company. They managed to pivot into their network and eventually onto dev workstations. Last I heard, they were grepping through devs’ home dirs looking for admin keys and such, to see how far they could go.

The difference between that situation and this, is that at every single step of the way, Mtso was in constant contact with the target company and the higher ups knew exactly what was happening as it happened. The target company wanted to know how far we could get. After all, that’s what they were paying for.

(Red teaming is even cooler — it’s that, but breaking into buildings.)

But when you’re an outsider, you don’t have any institutional protection. So it’s doubly important to follow standard procedures (see Hacker One for examples).

I thought of a rule of thumb: if you’re getting information from a PoC that might benefit you / your business, it’s not merely a security PoC anymore. It’s an active exploit that you’re benefiting from.

But again, it’s an easy mistake to make without thinking carefully.

Post reply on HN