Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Humble Return

projecteuler.net

Post reply on HN
Print view View original

71–80 of 127 posts

Re: Project Euler Humble Return

#71

Post by [deleted] »

zajd wrote: post #30
dang wrote: post #16

Earlier quoted context omitted.

Please don't post backhanded swipes like this, or outright insults like "This guy is a moron." [1] The idea on HN is to comment civilly and substantively [2], or not at all. 1. https://news.ycombinator.com/item?id=10023513 2. https://news.ycombinator.com/newsguidelines.html

Fair enough, just frustrated with the overwhelming number of "the modern internet is broken!!" posts that have been clogging up the front page lately. That also happened to be one particularly light on content.

[deleted]

Re: Project Euler Humble Return

#72

Post by krapp »

mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

csrf tokens would be nice too.

Re: Project Euler Humble Return

#73

Post by uxcn »

ProjectEuler wrote: post #48
krapp wrote: post #40

Earlier quoted context omitted.

Probably. If they're not using PDO then that needs to be their first priority, dead stop. After that, maybe looking at their captcha script, because those sometimes have issues if they're not well designed. I don't know where theirs comes from but it doesn't seem to use much obfuscation so it's probably old. After that, Twig. Although judging by a screenshot of the recent hack[0] posted here[1] escaping (and XSS) may…

Admin from PE here. We've already been using PDO. As for overall privacy/security, please see https://projecteuler.net/privacy

I genuinely hope the security hole is findable/fixable. Thank you guys for continuing to run an awesome service, despite asshats repeatedly trying to abuse it.

Re: Project Euler Humble Return

#74

Post by daguava »

You can list what problems you've solved by showing an image generated for you.

Ex) https://projecteuler.net/profile/daguava.png

But you can also use this to quickly test the status of accounts.

For example, I was able to find Euler is an admin account by trying

https://projecteuler.net/profile/euler.png

It tells you it's admin in the image, why?

Edit: Wonder if they're exposing some vulnerability with the HTTP 300 Multiple Files they're returning.

If you try something like this: https://projecteuler.net/profile/.wat

the page confirms a .htaccess file exists at https://projecteuler.net/profile/.htaccess we also find one at https://projecteuler.net/.htaccess

While currently inaccessible, this is significant information leak

All directories allow this, so you can do some digging to find what files exist.

Edit 2:while logged in, you can enumerate all usernames with a skill level attached by using URLs like

https://projecteuler.net/level=1

If you try changing the level to a period, the page conveniently tells you there are over 118k users in total (listing the first 10k), and MAY even show accounts without levels, but I'm not sure.

Combine this with the profile image URLs above and you may be able to find more admin account usernames if they have levels associated with them.

Re: Project Euler Humble Return

#76

Post by ghshephard »

teach wrote: post #69
ghshephard wrote: post #59

Earlier quoted context omitted.

There is a lot of risk going to a compromised website. You are basically inputting potential malware onto your computer, and, if there are zero-days present on your system, handing control of your computer over to a malware author.

Yes, I'm pretty worried about browsing a website with no ads using Chrome on my Linux machine with uBlock origin and Flash disabled. I think I take greater risks going for a walk in the evening.

A random website? Absolutely, 99.999% of the Web is safe. But we're talking about a site which is specifically compromised with malware.

With that said - "Linux" is safe by being such a tiny population of the community that browser malware generally isn't written for it. In general, I take it as a given that people have deleted/disabled flash and java plugins a long, long time ago.

Re: Project Euler Humble Return

#77

Post by jlarocco »

ghshephard wrote: post #76
teach wrote: post #69

Earlier quoted context omitted.

Yes, I'm pretty worried about browsing a website with no ads using Chrome on my Linux machine with uBlock origin and Flash disabled. I think I take greater risks going for a walk in the evening.

A random website? Absolutely, 99.999% of the Web is safe. But we're talking about a site which is specifically compromised with malware. With that said - "Linux" is safe by being such a tiny population of the community that browser malware generally isn't written for it. In general, I take it as a given that people have deleted/disabled flash and java plugins a long, long time ago.

> A random website? Absolutely, 99.999% of the Web is safe. But we're talking about a site which is specifically compromised with malware.

Well, we don't know that, actually. The info given on the PE site say that the attacker gained access to the server and modified the database. Do you have proof that it's serving up malware to visitors?

In any case, it's an odd situation and an odd response from Project Euler. It doesn't seem like a complicated enough site to get hacked in a mysterious undetermined way.

Re: Project Euler Humble Return

#78

Post by dongkyun »

mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

Using what Daguva mentioned above, it looks like admin (https://projecteuler.net/profile/admin.png) is just a regular accounts, compared to say, euler (https://projecteuler.net/profile/euler.png)

Re: Project Euler Humble Return

#79

Post by gherkin0 »

a_t48 wrote: post #21
gherkin0 wrote: post #19

Earlier quoted context omitted.

> 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. They shouldn't be storing passwords at all so storage space should be a non-issue. My 20 meg password should hash down to the same small(er) value as your 15 character one.

When there will be multiple shorter passwords that hash to the same value, is there a point to a 20mb pass?

I misspoke, I meant size.

Re: Project Euler Humble Return

#80

Post by mhink »

daguava wrote: post #74

You can list what problems you've solved by showing an image generated for you. Ex) https://projecteuler.net/profile/daguava.png But you can also use this to quickly test the status of accounts. For example, I was able to find Euler is an admin account by trying https://projecteuler.net/profile/euler.png It tells you it's admin in the image, why? Edit: Wonder if they're exposing some vulnerability with the HTTP 300 M…

So basically, by telling us this, you're completely contravening the request they made that security vulnerabilities be disclosed privately?

Kind of a jerk move.

Post reply on HN