Clubhouse data leak: 1.3M user records leaked online for free

https://cybernews.com/security/clubhouse-data-leak-1-3-million-user-records-leaked-for-free-online/

by 0xmohit • 5 years ago

306 82 5 years ago

cybernews.com

jtokoph• 5 years ago

It looks like someone just scraped all of the public profiles.

bloudermilk• 5 years ago

Yup, this seems to be the case. I don’t know how this could be characterize as a leak?

eswat2• 5 years ago

It's definitely a grey area here. Clubhouse strongly encourages using real names on their platform. That can be considered personal information that should be protected by security controls that they seem to lack, based on what others have mentioned here, that could have limited this "leak".

Zealotux• 5 years ago

It looks more like a SQL dump to me. The data doesn't seems to be too critical however.

tW4r• 5 years ago

How so? It is exactly the data you see when you open any clubhouse profile in the app

Almost as if there was an endpoint /profiles/id that someone just scrapped by using id 0..9999999999

frombody• 5 years ago

If I were collecting a large amount of data, I would most likely store it in a database.

lovedswain2• 5 years ago

I guess a leak requires private data to be exposed, this is just a collection of public data.

gabipurcaru• 5 years ago

Same as the recent FB and Linkedin incidents. It's all scraped data. Doesn't mean that collecting public data at scale is not something bad

kostarelo2• 5 years ago

Which one are you referring to? The recent millions of contacts that were exposed from FB contained phone numbers. It had my phone number and it's not public.

p49k• 5 years ago

Is it public info who invited you to the Clubhouse app? If not, that would assume some kind of breach, since that info is part of the leak.

saurik• 5 years ago

Is it public info who invited you to the Clubhouse app?

Yes: that is public info. This is all no more a "leak" than the original service is a "leak" of itself.

ThomPete• 5 years ago

Everyone can see who invited you to Clubhouse down in the bottom of the profile.

Kiro2• 5 years ago

It's not only public, it's central to the whole concept. You can always walk up your tree to see who the original member in your line is.

xyst2• 5 years ago

I agree. This "hack" is the equivalent of any search engine indexing public Facebook or LinkedIn profiles.

_trampeltier• 5 years ago

2021 the year of leaks ..

quickthrower2• 5 years ago

Hopefully this is a good omen for Julian

o_m• 5 years ago

Not really. It seems like we have redefined what a leak is.

rvz• 5 years ago

From [0]:

This is misleading and false. Clubhouse has not been breached or hacked. The data referred to is all public profile information from our app, which anyone can access via the app or our API.

So just like what happened to Parler and LinkedIn. A so-called 'data breach' of its public data via scraping.

But last time I checked on the private API in a GitHub repo, Clubhouse is using integer IDs which are not random alphanumberic strings for its users.

This can essentially be scraped by a while loop, incrementing all the way to whoever last signed up.

Did Clubhouse even implement rate limiting to combat this?

[0] https://twitter.com/joinClubhouse/status/1381066324105854977

sschueller• 5 years ago

Does anyone remember the ATT "Hack"? These two just used curl to get e-mail address and ICC-ID of ATT iPad users which where publicly accessible. [1] It was still labeled a hack and went through the brain dead media that way. Instead of ATT getting in trouble Auernheimer got a 41 months sentence and the judge also ordered him and Spitler to pay $73,000 in restitution.

[1] https://www.wired.com/2013/03/att-hacker-gets-3-years/

FDSGSG2• 5 years ago

If this wasn't a hack, would a SQL injection have been a hack? Where do you draw the line?

What if they had exploited the heartbleed bug, would that have been a hack?

soulofmischief• 5 years ago

weev had a lot of friends come forth to defend his actions, but then he went full neonazi in prison and all of that support disappeared.

He now runs admin for The Daily Stormer and somehow finds a way to keep popping up in the worst places, can't seem to shake the guy.

Additionally, he didn't even do the legwork for the AT&T op, but really wanted to take credit for something for cool hacker cred, and it came back and bit him. I keep company with several people involved in that ordeal.

Kye• 5 years ago

It's only a problem if you think it's a problem for someone to trivially build a social graph for every person on your exclusive social network with lots of high profile people.

So...it's a problem.

eswat2• 5 years ago

Not a great response on their part since the article they reference in the tweet does not say that they have been breached or hacked. Only that there's a limited dataset of users out there and that Techmeme reached out to Clubhouse to know if they are aware of any breaches of their systems.

Pretty bad optics if the other stuff is true: incremental IDs, no rate limiting, tokens that don't expire.

mvanaltvorst• 5 years ago

Correct, and judging from someone else in this thread, it was even possible to use wildcard matching to get access to an entire list of users at once.

mittermayr2• 5 years ago

I reported this to Clubhouse in February, no response whatsoever (I am not involved in this leak, just to be extra clear). Essentially anyone with the token from the iOS app (MITMproxy + SSL kill switch) can query through the entire public (records are cleaned) user profile database. It supports wildcard queries and just responds with some 20M records you can page through if you have the time. It luckily (!) doesn't expose e-mail and phone number, which is why I also agree with others here that this is only mildly interesting. The news won't care, however. I think at around 4M users or so they switched from auto-increasing IDs to a better numbering format, until then all records remain as-is (increasing).

I think Clubhouse can fix this quite easily (limit the records returned in search!!!) and apply some harsher rate limits on a per-token basis (tokens never expire, that's another thing).

I think they relied a bit too much on certificate pinning. Once that's bypassed, it's relatively easy to query your way through the data. If you managed to grab someone else's token (which doesn't expire), you impersonate them (without logging the other session out), and continue to show up/talk in rooms using the Agora SDK as that person.

They also do upload phone numbers of the address book in clear-text (non-hashed), although I can see that there's not too much of a point because reverse-hashes can maybe work around this easily if not salted.

aasasd2• 5 years ago

Once that's bypassed

Do you mean that you trick the app into accepting a wrong cert? How does one do that, apart from decompilation?

captn3m0• 5 years ago

You usually recompile the app, or if you have a jailbroke phone - you can do it at runtime.

But considering how the API is documented now (and alternative third party apps exist), it might not even be necessary.

jeroenhd2• 5 years ago

Jailbreaking an iPhone and using a tool like SSL Kill Switch [1] or just plain, old Frida with a script like [2] will do the job. Jailbreaking is the hard part, especially for an up to date iPhone, after that there's loads of guides you can follow that disable certificate validation for pretty much every application. It all boils down to hooking the necessary validation functions and having the APIs lie to the app code.

Some apps package their own crypto helpers (often with big crypto problems) to make this harder and require actual reverse engineering, but those are a pain to maintain and it's only a matter of time before someone finds a way around them. If you can extract the symbols (so if the app has not been obfuscated well) you can use Frida's API to hook those as well through any language you like. There's even an interactive Javascript console you can hook into the apps you're hooking!

Certificate pinning is a great way to protect users' security and privacy, especially in countries with questionable governments or ISPs, but it won't protect your app's secrets.

[1] https://github.com/nabla-c0d3/ssl-kill-switch2 [2]: https://techblog.mediaservice.net/2020/08/ios-13-certificate...

nerdbaggy• 5 years ago

iOS you can use Charles app and intercept https request without any extra device.

https://www.charlesproxy.com/documentation/ios/

bitexploder3• 5 years ago

Nothing wrong with auto incrementing identifiers if actual security controls (authorization) are implemented for already authenticated users.

yardstick2• 5 years ago

Sequential is still bad if you don’t want to disclose the size of your customer base or other commercially sensitive information.

Also see the German Tank Problem[1].

1. https://en.m.wikipedia.org/wiki/German_tank_problem

sangnoir2• 5 years ago

If you follow the "defense in depth" paradigm, then sequential identifiers bad when the other controls are defeated. Sequential ID make it trivial to crawl the entire dataset - which could be the difference between "Information on 4 million users was stolen" and "information from 4 users was stolen"

ramoz• 5 years ago

I was in some of those CH convos with you. I was actually suspended for a little while and tried clearing it up with them. Sent all the details I had and the original google doc I published w/ a lot of styprs work. They never responded but I was unbanned and given some fresh invites... but yea... strange it hasn't been cleared up.

Ultimately I think the premise is around a completely open and a transparent digital experience. Clubhouse still needs to defend against those with malicious intent and a new realm of psychographics to abuse.

Side note: I was hooked on the app until that suspension (lasted ~2w)... I haven't been able to get back into a groove. I rarely log on anymore.

rsj_hn• 5 years ago

Reading your post, it's amazing the checkboxes of failed access control efforts:

* trying to control clients

* obfuscating IDs

* rate limiting data

...rather than the more boring yet standard approach of thinking through an access control policy and then enforcing that at the server.

tonetheman• 5 years ago

All of their devs must be too busy working on an Android app to fix these minor security bugs... :)

monkey_monkey• 5 years ago

Perhaps we need to add a term such as "harvesting", to better distinguish between hacks/leaks and mass aggregation of public profile data.

kulikalov• 5 years ago

Why is this a leak? Looks like someone scraped the data any user has access to. If this is a leak, then the cybernews.com feed should be filled with linkedin/if/fb/etc leaks every minute.

hashhar• 5 years ago

Looks like it's a scrape of public profile information from Clubhouse.

Also it reads more like an advertisement for the author's services.

I'd like to see a more credible source.

coldcode• 5 years ago

That someone who wrote an iOS app with such a lame concept of security that anyone could dump the entire database (even if its only "public" data) in a script is not surprising, as most startups and even big companies don't give a crap about security. I've seen this way too often. If you are so cavalier about security in simple rest queries, imagine what lurks beneath not yet discovered.

benja123• 5 years ago

I understand why people are saying this is not a breach and I tend to agree. I do think there are some basic measures you can put in place to make this kind of abuse harder.

The real problem is that most users don’t understand when they sign up for a service like clubhouse, what information is public, how easy it is for bad actors to get access to that information and how this information can be used to harm them later (phishing, identity theft etc.).

Who should be educating the average non technical user about the risk of agreeing to share you information publicly and even if they knew would it actually change anything.

Personally, I have hit the point where I have accepted that all my -and my families information is public and for that reason with people like my parents I tend focus on teaching them to avoid falling for phone scams and phishing.

brown9-2• 5 years ago

As long as we are talking about “leaks”, someone at Clubhouse might want to look into being compliant with California’s Consumer Privacy Act:

https://twitter.com/wbm312/status/1360014416087945222?s=21

ulzeraj• 5 years ago

This is the cherry on the top for their policy that requires real names. People never learn.

asimjalis2• 5 years ago

They also know your birthdate and phone number. The only thing they don’t know is the name of your first pet.

judge2020• 5 years ago

These things weren’t exposed via the API.

swiley• 5 years ago

I'm completely done with centralized social media "apps." I'm not signing up for any more and other than HN I've stopped using all of them and recommended that my friends do the same (surprisingly, many have listened.)

cblconfederate3• 5 years ago

I think we're watching the implosion of the cloud. Those leaks are not even illegal, yet they will lead to a lot of spam, a lot of phishing, and a lot of other clumsy actions by clumsy actors that will alienate users and make them more reluctant to give their information next time. At least, i hope we re post peak cloud and falling fast into the norm of the internet the way it was meant to be: pseudonymous

runeks• 5 years ago

I don’t get it. This “leaked” information looks like something that would be displayed on a public website for each user. As far as I can see it’s just public information, like user names and avatars on e.g. stack overflow.

cblconfederate3• 5 years ago

The difference is it's all in a SQL dump that any kiddo can use to spam. Ease of use matters

asimjalis2• 5 years ago

I feel this validates their decision to only release on iOS first. On Android there would be even fewer barriers to this kind of scraping.

rogers18445• 5 years ago

This data seems to have been public and free for a while... Here: https://www.kaggle.com/johntukey/clubhouse-dataset

xyst2• 5 years ago

The generated graph is interesting. I guess everyone in the middle are early adopters and people with high numbers of followers. Then the clusters on the outer edges are people catering to a niche audience. Then those niche audiences spawn their own microcosm

Clubhouse data leak: 1.3M user records leaked online for free

Related Stories