How I Hacked Hacker News (with arc security advisory) • Hacker News Board

Re: How I Hacked Hacker News (with arc security advisory)

#11

Post by edw519 » Wed, Jun 03, 2009, 5:13 PM UTC

Fellow hackers, take note. This is how you solve a problem! dfranke is Pandora, a rat in a maze, Sherlock Holmes, General Sherman, William Randolph Hearst, and your father all wrapped in one.

Like Pandora, he is so curious, he has to check this out.

Like a rat in a maze, he keeps going looking for the clear path.

Like Sherlock Holmes, he applies logic to determine the next step.

Like General Sherman, he keeps marching, building tools along the way as he needs them.

Like William Randolph Hearst, he defines the landscape. ("You provide the pictures, I'll provide the war.") "so I decided on a more proactive approach: crash it!" (hilarious)

And like any parent, he didn't quit until his baby walked.

Thank you, Daniel. I sure hope you've found a way to channel that talent in your day job.

Re: How I Hacked Hacker News (with arc security advisory)

#12

Post by edw519 » Wed, Jun 03, 2009, 5:18 PM UTC

icey wrote: post #4

This is pretty interesting stuff, but man it would have been nice if you were able to post it somewhere with actual HTML formatting. The gray on gray is tough after a full screen or two.

Ctrl-A, Ctrl-C, Alt-Tab, Ctrl-V

Re: How I Hacked Hacker News (with arc security advisory)

#13

Post by lexx12 » Wed, Jun 03, 2009, 5:18 PM UTC

awesome! :)

Re: How I Hacked Hacker News (with arc security advisory)

#14

Post by tptacek » Wed, Jun 03, 2009, 5:28 PM UTC

dschobel wrote: post #3

Very impressive. Are a you a professional security researcher or just a programmer who tilts that way?

If he's not a professional security researcher, it's obviously because he doesn't want to be one. =)

Re: How I Hacked Hacker News (with arc security advisory)

#15

Post by dfranke » Wed, Jun 03, 2009, 5:29 PM UTC

mariorz wrote: post #9

>"Nonetheless, online brute force would still be manageable. If each page view produces an average of 50 candidates, and one in every thousand page views is a login (this might be slightly optimistic), that's 50,000 attempts necessary in order to find a working login. HN gets about 500,000 hits on a busy day, so this could be done in a day or two while likely staying under the radar." You would have a fnid that is in…

I was looking for login cookies, not fnids. Fnids are worthless since there's already code that checks that the user who called the closure is the same as the user for whom it was created.

Re: How I Hacked Hacker News (with arc security advisory)

#16

Post by froo » Wed, Jun 03, 2009, 5:34 PM UTC

edw519 wrote: post #11

Fellow hackers, take note. This is how you solve a problem! dfranke is Pandora, a rat in a maze, Sherlock Holmes, General Sherman, William Randolph Hearst, and your father all wrapped in one. Like Pandora, he is so curious, he has to check this out. Like a rat in a maze, he keeps going looking for the clear path. Like Sherlock Holmes, he applies logic to determine the next step. Like General Sherman, he keeps marchin…

Like Pandora, he is so curious, he has to check this out.

Slight error, Pandora was a female in greek mythology (well, the first female to be more precise)

Re: How I Hacked Hacker News (with arc security advisory)

#17

Post by [deleted] » Wed, Jun 03, 2009, 5:40 PM UTC

froo wrote: post #16

edw519 wrote: post #11

Fellow hackers, take note. This is how you solve a problem! dfranke is Pandora, a rat in a maze, Sherlock Holmes, General Sherman, William Randolph Hearst, and your father all wrapped in one. Like Pandora, he is so curious, he has to check this out. Like a rat in a maze, he keeps going looking for the clear path. Like Sherlock Holmes, he applies logic to determine the next step. Like General Sherman, he keeps marchin…

Like Pandora, he is so curious, he has to check this out. Slight error, Pandora was a female in greek mythology (well, the first female to be more precise)

[deleted]

Re: How I Hacked Hacker News (with arc security advisory)

#18

Post by mattyb » Wed, Jun 03, 2009, 5:41 PM UTC

froo wrote: post #16

edw519 wrote: post #11

Fellow hackers, take note. This is how you solve a problem! dfranke is Pandora, a rat in a maze, Sherlock Holmes, General Sherman, William Randolph Hearst, and your father all wrapped in one. Like Pandora, he is so curious, he has to check this out. Like a rat in a maze, he keeps going looking for the clear path. Like Sherlock Holmes, he applies logic to determine the next step. Like General Sherman, he keeps marchin…

Like Pandora, he is so curious, he has to check this out. Slight error, Pandora was a female in greek mythology (well, the first female to be more precise)

I believe those 'he's refer to dranke, not Pandora.

Re: How I Hacked Hacker News (with arc security advisory)

#19

Post by jmtulloss » Wed, Jun 03, 2009, 5:43 PM UTC

froo wrote: post #16

edw519 wrote: post #11

Fellow hackers, take note. This is how you solve a problem! dfranke is Pandora, a rat in a maze, Sherlock Holmes, General Sherman, William Randolph Hearst, and your father all wrapped in one. Like Pandora, he is so curious, he has to check this out. Like a rat in a maze, he keeps going looking for the clear path. Like Sherlock Holmes, he applies logic to determine the next step. Like General Sherman, he keeps marchin…

Like Pandora, he is so curious, he has to check this out. Slight error, Pandora was a female in greek mythology (well, the first female to be more precise)

I think the "he" is dfranke in this context.

Re: How I Hacked Hacker News (with arc security advisory)

#20

Post by mariorz » Wed, Jun 03, 2009, 5:46 PM UTC

dfranke wrote: post #15

mariorz wrote: post #9

>"Nonetheless, online brute force would still be manageable. If each page view produces an average of 50 candidates, and one in every thousand page views is a login (this might be slightly optimistic), that's 50,000 attempts necessary in order to find a working login. HN gets about 500,000 hits on a busy day, so this could be done in a day or two while likely staying under the radar." You would have a fnid that is in…

I was looking for login cookies, not fnids. Fnids are worthless since there's already code that checks that the user who called the closure is the same as the user for whom it was created.

My mistake. So you can get a valid login, but you can't know whom you'll be login in as, that is without doing some social engineering like with the irc example. Impressive hack.