Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iViewed your API keys

wale.id.au

Post reply on HN
Print view View original

41–50 of 116 posts

Re: iViewed your API keys

#41

Post by someotherperson »

OJFord wrote: post #11
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

I booked a hotel stay (in Canada, not Australia) and got an error page at some point that dumped out all env vars including database credentials. Tried my best to report (not publicly disclose) it, including asking the front desk for contact information for IT; no response. I think we're (on HN) often in quite a bubble of being (or striving to be) hot on this sort of thing, or frankly far trickier to exploit sorts of…

Leaks are everywhere. I went to a certain country and needed to register my phone, somehow ended up in a workflow that allowed me to enter any national registration number (similar to a social security number) and it would output the person's name, phone number, address and other details for me to confirm that that was me :)

No rate limiting on the endpoint, doesn't require auth, didn't block my VPN, doesn't even set cookies (very privacy conscious devs apparently). I could have mined the entire country's data. Insane.

Re: iViewed your API keys

#42

Post by notamy »

harg wrote: post #36

I'm not sure how bad this actually is. I haven't examined all the env variables exposed, but it's fairly common to expose public-facing api keys for services that require client-side communication with a 3rd party API. E.g. for client-side bug tracking, search etc.

If you look at the env vars in there, you can see things like $PATH and $HOME leaked.

Re: iViewed your API keys

#43

Post by nerdawson »

michaelt wrote: post #27
Oberbaumbrucke wrote: post #7

Earlier quoted context omitted.

Completely agree. The AU Gov would probably call this hacking

Quite a few countries have laws from the 1980s that basically say "gaining unauthorised access to computer systems is a crime" Which is of course a very expansive definition. Think you've found a leaked database credential and you test it before reporting, so as not to create a false alarm? That's illegal hacking. Almost any persistent XSS? That's illegal hacking. Access an admin panel by entering a default password?…

Both the first and third example you gave would strike me as crossing the line.

Without permission to test the security of a system, you shouldn't be trying credentials you've stumbled upon or defaults.

If you randomly try my front door and find that it's unlocked, don't expect me to be thanking you.

Re: iViewed your API keys

#45

Post by jeroenhd »

harg wrote: post #36

I'm not sure how bad this actually is. I haven't examined all the env variables exposed, but it's fairly common to expose public-facing api keys for services that require client-side communication with a 3rd party API. E.g. for client-side bug tracking, search etc.

Currently, most strange state keys seem to have been removed. When you check the web archive (http://web.archive.org/web/20211201000716/https://iview.abc....) though, you can see variables like "USER": "www-data", "HOME": "/var/www" and "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin". There's something called "DRM_WEB_SECRET" which isn't currently in the HTML anymore, I'm guessing they shouldn't have shared that.

Re: iViewed your API keys

#46

Post by Grimburger »

nojs wrote: post #37

*.id.au is an interesting domain that I haven’t seen before. Apparently you can get an id.au iff you’re an Australian citizen, and it must approximately match your real name.

From my experience it's very common with infosec students in Australia, the general public barely know it exists and probably consider it a weird second level domain.

It doesn't need to be anything like your real name, much like only needing a registered aus company to own a *.com.au

Re: iViewed your API keys

#47

Post by spicybright »

blenderdt wrote: post #40
harg wrote: post #36

I'm not sure how bad this actually is. I haven't examined all the env variables exposed, but it's fairly common to expose public-facing api keys for services that require client-side communication with a 3rd party API. E.g. for client-side bug tracking, search etc.

If it is a paid service other can now use the service while you pay the price. And the API might also expose data you don't want to expose to the public. That's why you never put these on the client side. There are better options, for example a proxy that injects tokens into the header.

Handing anyone your API key to use as they want is just asking for trouble. I'm shocked some people think that's an ok pattern to do...

Re: iViewed your API keys

#48

Post by mardifoufs »

Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

But why is the Australian government so "police state" minded?

Is that really what the Australian people want? I'd guess they just don't care either way, but in that case why would the Australian politicians push for that? Canada has a pretty similar apathy towards politics but even then we don't see the government forcing Canadian citizens to implement backdoors or raiding the offices of a broadcaster. (Yes the recent C-36 and C-10 bills are pretty disastrous in that regard but they are very recent and face quite a bit of opposition)

It's such a peaceful country too, so the entire "hard on crime" policy does not make sense to me. Is it a partisan issue in Australia or is it something both parties agree on?

Re: iViewed your API keys

#49

Post by raxxorraxor »

alias_neo wrote: post #10
raxxorraxor wrote: post #6

To be fair, I think a lot of developers begin with that. There is a logistical problem in providing secrets to a process without getting the secret exposed. Environment variables are an often chosen approach. Of course when the software is tested and ready to be deployed, the step to use a secure container containing credentials is often neglected like it was probably done here. This isn't necessarily sloppy programm…

The step they seem to be missing is _the entire development process_. If you're using API keys to access stuff, you do it on your backend, there's no excuse for that stuff to make it to the frontend. If your "client" needs access to sensitive API keys, you need to rethink your architecture. As a (senior) backend software engineer, this reeks of a person/team who doesn't know how to architect and/or implement web appl…

Yeah, it shouldn't reach the client in any case. But providing secrets to applications isn't really a well solved problem in my opinion. Even if it is just an environment variable for the server process it could get exposed.

If a clients needs an API key I would think to route the requests through the server and add the key information at that point, but I am not a web developer and not sure if that always scales for any use case.

Re: iViewed your API keys

#50

Post by cortesoft »

someotherperson wrote: post #41
OJFord wrote: post #11

Earlier quoted context omitted.

I booked a hotel stay (in Canada, not Australia) and got an error page at some point that dumped out all env vars including database credentials. Tried my best to report (not publicly disclose) it, including asking the front desk for contact information for IT; no response. I think we're (on HN) often in quite a bubble of being (or striving to be) hot on this sort of thing, or frankly far trickier to exploit sorts of…

Leaks are everywhere. I went to a certain country and needed to register my phone, somehow ended up in a workflow that allowed me to enter any national registration number (similar to a social security number) and it would output the person's name, phone number, address and other details for me to confirm that that was me :) No rate limiting on the endpoint, doesn't require auth, didn't block my VPN, doesn't even set…

How do you know it wasn’t rate limited?
Post reply on HN