Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

eng.getwisdom.io

Post reply on HN
Print view View original

1–10 of 231 posts

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#2

Post by ljm »

So if I understand this right, what GitHub did was something like:

    user = get_user_from_valid_email(params[:email])
    send_reset_email(params[:email])
    # instead of
    # send_reset_email(user.email)
?

I've seen this pattern before and the reason is usually something about using the variable in memory as opposed to the function call. Total non-optimisation.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#3

Post by deathanatos »

This blog sets opacity: 0 (fully invisible) on the entire content, then fails to unset that CSS with JS, b/c the JS crashes if you block cookies.

> because the system lowercased the provided email address and compared it to the email address stored in the user database.

While sending the email to the attack-provided email, instead of the one in the database, is bad… lowercasing emails is also not valid. The lookup should never have matched in the first place.

(It's slightly more complicated: to an extent, the case of the domain name doesn't matter, ignoring non-ASCII characters — I have no idea what they do. But the local part — the portion before the @ — is case sensitive. A server is free to ignore that, and map multiple local parts to the same mailbox internally¹, and many do, but the sender cannot make that assumption.)

¹or do other weird things, like ignore dots, or +extensions, etc.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#4

Post by _jg »

ljm wrote: post #2

So if I understand this right, what GitHub did was something like: user = get_user_from_valid_email(params[:email]) send_reset_email(params[:email]) # instead of # send_reset_email(user.email) ? I've seen this pattern before and the reason is usually something about using the variable in memory as opposed to the function call. Total non-optimisation.

Yes! Add in a toLowerCase() in there as well.

An apparently small deviation with surprisingly large repercussions.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#6

Post by notlukesky »

The likelihood of such a “hack” happening using the Turkish dotless “I” is ZERO as all Turkish email addresses and website domains are formatted WITHOUT using Turkish characters which include examples like: ç, ı, ü, ğ, ö, ş, İ, Ğ, Ü, Ö, Ş, Ç

If you are at interested in Turkish characters:

https://en.wikipedia.org/wiki/Wikipedia:Turkish_characters

https://www.turkcebilgi.com/türkçe_karakter

This should be called the Turkish character hack: A hack only possible in the theoretical realm.

These characters are rendered in HTML and supported by OSes. They are just not used for emails AND website domains.

So the password reset “hack” with an email containing Turkish characters in not a possibility from the get go.

The whole attack vector hinges on emails that exist with Turkish characters in the first place.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#7

Post by _jg »

deathanatos wrote: post #3

This blog sets opacity: 0 (fully invisible) on the entire content, then fails to unset that CSS with JS, b/c the JS crashes if you block cookies. > because the system lowercased the provided email address and compared it to the email address stored in the user database. While sending the email to the attack-provided email, instead of the one in the database, is bad… lowercasing emails is also not valid. The lookup sh…

Unfortunately convention has normalised user expectations that email addresses are now case-insensitive. It's now a standard business requirement. Too bad few devs fully handle Unicode.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#8

Post by _jg »

notlukesky wrote: post #6

The likelihood of such a “hack” happening using the Turkish dotless “I” is ZERO as all Turkish email addresses and website domains are formatted WITHOUT using Turkish characters which include examples like: ç, ı, ü, ğ, ö, ş, İ, Ğ, Ü, Ö, Ş, Ç If you are at interested in Turkish characters: https://en.wikipedia.org/wiki/Wikipedia:Turkish_characters https://www.turkcebilgi.com/türkçe_karakter This should be called the T…

This was a very real and demonstrated vulnerability. Perhaps I've misunderstood your comment.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#10

Post by notlukesky »

_jg wrote: post #8
notlukesky wrote: post #6

The likelihood of such a “hack” happening using the Turkish dotless “I” is ZERO as all Turkish email addresses and website domains are formatted WITHOUT using Turkish characters which include examples like: ç, ı, ü, ğ, ö, ş, İ, Ğ, Ü, Ö, Ş, Ç If you are at interested in Turkish characters: https://en.wikipedia.org/wiki/Wikipedia:Turkish_characters https://www.turkcebilgi.com/türkçe_karakter This should be called the T…

This was a very real and demonstrated vulnerability. Perhaps I've misunderstood your comment.

There are no emails with Turkish characters. The whole attack vector hinges on emails that exist with Turkish characters in the first place.
Post reply on HN