How I Hacked Hacker News (with arc security advisory) • Hacker News Board

Re: How I Hacked Hacker News (with arc security advisory)

#31

Post by tptacek » Wed, Jun 03, 2009, 6:09 PM UTC

dfranke wrote: post #29

edw519 wrote: post #11

Fellow hackers, take note. This is how you solve a problem! dfranke is Pandora, a rat in a maze, Sherlock Holmes, General Sherman, William Randolph Hearst, and your father all wrapped in one. Like Pandora, he is so curious, he has to check this out. Like a rat in a maze, he keeps going looking for the clear path. Like Sherlock Holmes, he applies logic to determine the next step. Like General Sherman, he keeps marchin…

Thanks, I think that's the most elaborate compliment I've ever gotten.

Also, like Brad Pitt, you have beautiful, silky, manageable hair.

Re: How I Hacked Hacker News (with arc security advisory)

#32

Post by chanux » Wed, Jun 03, 2009, 6:24 PM UTC

Who says open source code is less secure?

Re: How I Hacked Hacker News (with arc security advisory)

#33

Post by froo » Wed, Jun 03, 2009, 6:32 PM UTC

theblackbox wrote: post #28

froo wrote: post #16

Earlier quoted context omitted.

Like Pandora, he is so curious, he has to check this out. Slight error, Pandora was a female in greek mythology (well, the first female to be more precise)

most people don't know this and in the interest of knowledge I thought I'd point it out: Pandora was the wife of Prometheus (the Titan of Knowledge) who made all the animals and humanity (last of all and out of the only material he had left - clay). In order to give them life, he stole fire from the gods and gave it to his creations, for which he was bitterly punised. In one telling he was tied to a mountain and his…

And in the other telling, the box wasn't actually a box, but was a jar. It was incorrectly translated by someone (I forget their name, I should go look it up) and has stuck ever since.

EDIT - just looked it up, it was incorrectly translated by Erasmus of Rotterdam when he first translated Hesiod's tale into Latin from Greek.

Re: How I Hacked Hacker News (with arc security advisory)

#34

Post by e1ven » Wed, Jun 03, 2009, 6:38 PM UTC

mariorz wrote: post #26

xenophanes wrote: post #23

Earlier quoted context omitted.

i think if you get a valid login cookie, and use it, it will tell you what account you have in the top right.

Well obviously, but you couldn't do a brute force attack like this to a specific account.

I believe the implication is that you'd have a sessionid. Effectively, the username and password rolled into one unique number, stored in the cookie.

Re: How I Hacked Hacker News (with arc security advisory)

#35

Post by dfranke » Wed, Jun 03, 2009, 6:48 PM UTC

e1ven wrote: post #34

mariorz wrote: post #26

Earlier quoted context omitted.

Well obviously, but you couldn't do a brute force attack like this to a specific account.

I believe the implication is that you'd have a sessionid. Effectively, the username and password rolled into one unique number, stored in the cookie.

I think by 'specific account' he means 'chosen account', in which case he'd be correct without more targeted social engineering.

Re: How I Hacked Hacker News (with arc security advisory)

#36

Post by jgrahamc » Wed, Jun 03, 2009, 7:07 PM UTC

Very nicely done. This is precisely the attack that I described in a HN post a month ago. Glad to hear that it would have worked if I'd had time: http://news.ycombinator.com/item?id=596126

Re: How I Hacked Hacker News (with arc security advisory)

#37

Post by [deleted] » Wed, Jun 03, 2009, 7:12 PM UTC

edw519 wrote: post #12

icey wrote: post #4

This is pretty interesting stuff, but man it would have been nice if you were able to post it somewhere with actual HTML formatting. The gray on gray is tough after a full screen or two.

Ctrl-A, Ctrl-C, Alt-Tab, Ctrl-V

[deleted]

Re: How I Hacked Hacker News (with arc security advisory)

#38

Post by ShellDragon » Wed, Jun 03, 2009, 7:20 PM UTC

Brilliant sir! I'm your slave.

Re: How I Hacked Hacker News (with arc security advisory)

#39

Post by edw519 » Wed, Jun 03, 2009, 7:21 PM UTC

dfranke wrote: post #29

edw519 wrote: post #11

Fellow hackers, take note. This is how you solve a problem! dfranke is Pandora, a rat in a maze, Sherlock Holmes, General Sherman, William Randolph Hearst, and your father all wrapped in one. Like Pandora, he is so curious, he has to check this out. Like a rat in a maze, he keeps going looking for the clear path. Like Sherlock Holmes, he applies logic to determine the next step. Like General Sherman, he keeps marchin…

Thanks, I think that's the most elaborate compliment I've ever gotten.

Your welcome :)

I knew from previous discussions with you that you did work at this level, but this is the first time I had actually seen for myself. It read almost like a mystery and I found myself guessing what you'd do next. So I thought I'd pay a quick tribute with what came into my mind first.

AFAIC, you don't need a proposal or resume any more. Just email any prospect or prospective employer this link. If they don't see what you can do from this, you probably don't want to work for them anyway.

Re: How I Hacked Hacker News (with arc security advisory)

#40

Post by edw519 » Wed, Jun 03, 2009, 7:25 PM UTC

tptacek wrote: post #31

dfranke wrote: post #29

Earlier quoted context omitted.

Thanks, I think that's the most elaborate compliment I've ever gotten.

Also, like Brad Pitt, you have beautiful, silky, manageable hair.

What algorithm did you use to extract that conclusion from this data? I probably have a few customers for you.