After Snapchat and Dropbox, it's time to realise that the
Source: Charles Arthur
As it gets easier to access the web and associated services on our devices, we should trust the web less. Photograph: Linda Nylind/Guardian
Security is back in the news. Both Snapchat and Dropbox have had to deny that their own systems were hacked - but have seen thousands of photos and videos distributed (in the case of Snapchat) and millions of logins made available (in the case of Dropbox - except that they didn’t come from Dropbox).
In both cases, the blame has been laid at the feet of third-party websites. Snapsaved has been highlighted as the source of the Snapchat pictures (and the motives of those behind the site still are not clear); Dropbox says that the logins were stolen from “unrelated services”, and then used for login attempts.
That’s why it’s dangerous to give your login credentials for a key site to another one; security is a “weakest link” system, and so your credentials are only as safe as the weakest site you offer them to. It’s also why it is a bad idea to use the same password in different sites. It is in fact possible to create unique yet memorable site-specific passwords - all you need is a mnemonic system.
When did the web get so hostile? In truth, it’s always been risky, but the shift in the past decade from a world where the (Windows) desktop ruled to a world where mobile is just as big, if not bigger, has meant that web services have come under more intense attacks by hackers: if you get access to a web service then potentially you get everything. Hacking desktop computers is still big business; but it’s not where the action is.
Because mobile isn’t an operating systems monoculture as the desktop was, stealing logins is now the simplest avenue for many hackers. And how do you do that? Through phishing, or fake third-party services, or hacking legitimate ones.
Twitter and Facebook both faced the theft of logins through third-party services (authorised or not) during their early, fast-growth stages. Like a number of sites, they implemented OAuth: sites or apps wanting to access their APIs (so you could post or read your tweets or Facebook posts through them) first receive a “token” to access the API. If the service or site misbehaves, the token can be revoked; crucially, the site or service can’t see (or thus store) the user’s login details.
Cleansing insecurity
After Snapchat’s problems, there may be a wider cleansing of the very insecure practice of letting third-party sites have logins. Maciej Ceglowski, who runs the paid-for Pinboard bookmarking service (of which Guardian Tech is a user) announced that he would soon start blocking sites that allowed users to log into their Pinboard accounts directly. He cited Packratius, “which angers me especially by asking users to provide their Pinboard password in order to duplicate a native Pinboard feature”.
He also cited IFTT - which overnight shifted to the third-party authentication system. Clearly, all it takes for a site that cares about its users to change is the threat of a shutdown. And so the web is a little more secure.
That won’t be the end of it, though. Dropbox already implements a token-based system; that doesn’t mean it could prevent people using the same logins on sites which were then hacked.
But Chris Eng, vice president of security research at Veracode, suggests that Snapchat doesn’t deserve much sympathy. In fact, he says, in the face of repeated security faults it has done the minimum, each time, that would keep it just ahead of each flaw.
“For a long time you could ‘brute force’ their Find Friends API, which meant you could cycle through all phone numbers and figure out which Snapchat users those corresponded to. Someone released a proof of concept list of 5 million users to demonstrate the flaw,” Eng says.
“They then reduced the number of Find Friends calls you could make, but they didn’t prevent you from creating an unlimited number of accounts, so the attack still worked. Then they said they were enforcing one account per phone number, but they messed up the verification process. Later they added a CAPTCHA to prevent automated account creation, but a grad student broke that within a day.”
Eng argues that “they only did the bare minimum at each step, and they clearly didn’t consult with experts on the design and implementation of each fix. They also used the same encryption key for everything, which could be easily extracted from the mobile app.”
Posture of emphemerality
What then could Snapchat actually do to prevent third-party sites hacking the app and offering people the chance to store the pictures that are meant, in theory, to be deleted within a sender-determined number of seconds?
Eng responds: “Content ‘expiration’ is largely marketing hype. If you send an image to someone else, via Snapchat or another service promising ephemeral content, you should always assume the recipient can make a copy of it. That may be done by installing a third-party app, taking a screenshot, or even using another camera to take a photo. Even if you are using the official app, you have no idea what the person on the other end is doing. The best Snapchat could do in this case is to more aggressively police impostor apps.”
He suggests that Snapchat should have pursued (and still should pursue) the third-party apps that have enabled the capture of Snapchat photos more aggressively; as he points out, until its blogpost this week, Snapchat didn’t even tell people to avoid those services.
What’s the solution? A token-based authentication system would allow Snapchat to block misbehaving third-party apps. But that it wouldn’t stop a site such as Snapsaved.com from being hacked for its pictures; nor would it prevent the creation of a malicious site that stores pictures in order to sell or trade them without the owner’s consent. Revoking such a site’s token wouldn’t get the pictures back.
“[A token system] wouldn’t completely prevent third-party apps from masquerading as the official app, but right now they’re not even requiring impostor apps to jump through that hoop,” says Eng, who adds that “My point about their security posture in the past is not to say that their posture is the reason for this latest hack, but rather to point out that they generally don’t seem to place a lot of importance on security/privacy.”
Web considered hostile
Eng’s general point for Snapchat - that it has been too trusting of apps and login attempts - is applicable more broadly. We’ve all been doing it. New services spring up and ask for an email and for us to create a password; many feel too exhausted to create yet one more. (See above: you can, and should.)
With the number of hacking reports and vulnerabilities rising all the time, it’s time to understand we’ve moved from a place where we can trust the web implicitly, to one where we should only trust very limited pieces, and some of the mechanisms that let us link those together. It’s been a long time - if ever - since any of Twitter, Facebook, Dropbox, Google or Apple were directly hacked in a way that gave hackers free rein to their internal systems, but each has seen intrusions of varying severity via login-based attacks. It’s the login, not the service itself, that’s weak.
It’s unfortunate that as it gets easier to access the web and associated services on our devices, and as more people have access to those internet-capable devices, we should trust the web less. But it seems to be an inevitable side-effect: websites should be considered hostile, unless you have evidence otherwise.
| }
|