We found critical vulnerabilities in Hive Social

by pantalaimon • 4 years ago

219 78 4 years ago

spindle• 4 years ago

summary quotes:

The issues we reported allow any attacker to access all data, including private posts, private messages, shared media and even deleted direct messages. This also includes private email addresses and phone numbers entered during login.
Attackers can also overwrite data such as posts owned by other users

charcircuit• 4 years ago

no authorization on some endpoints + enumeration I presume

StanislavPetrov• 4 years ago

Just want to point out that Hive Social is completely unrelated to Hive Blog (which is also a social network of sorts on the Hive blockchain).

https://hive.blog/

leoh2• 4 years ago

Oh, thank goodness the other hive is as safe as crypto.

namkt• 4 years ago

Is there a 'rick-rolled' meme but with blockchain?

panzi2• 4 years ago

There also seems to be something similar to Slack that's called Hive. Not very unique name.

Tepix2• 4 years ago

Also unrelated to TheHive project, a security incident response tool.

https://thehive-project.org/

drunkenmagician2• 4 years ago

4 days from reporting to public posting is not a responsible disclosure policy. Even if they are slow in responding, the usual grace period is about 4 weeks if I recall.

endigma• 4 years ago

They don't offer a guide or any details about the exploit, this isn't really disclosure in the normal sense. Aside from any possible alterior motives the author may be just trying to light a fire under hive social's ass to get it fixed.

joe-collins• 4 years ago

In kindness and for future reference, the word you're looking for is spelled "ulterior".

yellow_lead• 4 years ago

This isn't disclosure

p1necone2• 4 years ago

1. They haven't disclosed anything of use to an attacker.

2. According to the post, Hive responded and said the issues had been fixed. Obviously they haven't, and at this point OP seems to have decided that the most responsible thing to do was to warn users of the platform that they aren't safe.

I don't really see a problem with this.

zelon88• 4 years ago

1. They haven't disclosed anything of use to an attacker.

I also don't believe this is "responsible" disclosure, but I also don't think it's fair to say this information is of no use.

To me this clearly signifies that there is no back-end authentication on their API. The whole app is probably written in JS with a simple database on the backside with no serious middleware on the server side. It would probably not be difficult to reverse engineer this hack by monitoring requests using simple dev tools, and then simply replaying them with altered content.

Kiro4• 4 years ago

Where does it say Hive claimed the issue had been fixed? I think you misread it.

drunkenmagician2• 4 years ago

So, not disclosure from a security ops / policy perspective, but it is 'disclosure' this the equivalent of a 'here be dragons' comment on a map ... an endorsement for the 'curious'

leoh2• 4 years ago

Don’t worry, I won’t.

Snark aside, I think the current platforms are going to be the only ones folks use; and then there’s going to be stuff that is entirely different.

These clones are getting just silly.

Holidaylogin2• 4 years ago

It would helpful if the reporter confirmed that this is an issue with this particular front-end and not with Hive in general.

Steem/Hive was the first web3 offering and a lot of new 'web3' projects that are getting a lot of publicity have yet to catch up the basics that Steem/Hive had in place 6 years ago.

MBCook3• 4 years ago

Wrong hive.

This is a social network that has recently exploded. My understanding is a ton of games industry people moved to it off Twitter.

It has nothing to do with “Web3”. It’s not a front end.

It’s a native iPhone app. No web presence at all at the moment.

Holidaylogin2• 4 years ago

Thanks TIL. That would be helpful information for the reporter to include too.

rurcliped• 4 years ago

At least one other person reported Hive Social vulnerabilities recently: https://twitter.com/zhuowei/status/1597739467645030400

lehi• 4 years ago

Hive is a My First App project from a teen who taught herself to code in 2019 (https://www.hivesocial.app/about-us).

Caveat emptor.

yawnxyz• 4 years ago

that's such a success story hitting 1M users as a hobby project, let alone from a teenager. I've never done anything close to this, and not for lack of trying...

waprin• 4 years ago

I've been in Bay Area high tech software for a long time now, and more recently I've been participating more in the indie hacker scene. It is fascinating to me that I do know many extremely talented engineers who either dream of setting out on their own and never do, or they try and repeatedly fail. Then random novices in circumstances far removed from tech teach themselves a little coding online and start making 5 figure MRR quickly.

There are somewhat obvious explanations. Coding is only one subset of the skills to launch a successful software business, and not even the most important one. There's also a huge element of randomness and luck, especially for a single given project and especially for any type of free b2c social app. Also, people outside Silicon Valley bubble have access to unique social circles that can serve as community "bootstrapping", which would be especially important for a social app

Even knowing all that, there's an element of surprise when you see it happen.

I do suspect another big factor is that experienced people overthink things a bit, much like a child seems to learn a language faster than an adult but may only be more willing to make silly mistakes. Many of the best startups and indie projects would never be started by many experienced engineers because they're perceived as too simple, the market is too saturated, or simply they feel they'd look foolish for trying and failing to do something simple instead of trying and failing something complex.

tablespoon• 4 years ago

that's such a success story hitting 1M users as a hobby project, let alone from a teenager. I've never done anything close to this, and not for lack of trying...

Sounds like a lot of it is just being in the right place at the right time. Apparently most of the growth consists of people trying to flee Twitter due to Musk. Though doing that sounds like jumping from a sinking ship into a toy paper boat.

mudream4869• 4 years ago

TLDR: Mastodon is more secure than Hive Social.

PaulsWallet• 4 years ago

Is it? Can't people read your DMs on Mastodon as well? If that is your concern then seems like all things are equal. I'm being somewhat obtuse but I don't see how Mastodon is a reasonable replacement for Twitter.

BaseballPhysics• 4 years ago

Is it? Can't people read your DMs on Mastodon as well?

"People"? No. Server operators, yes, but that's true of Twitter as well.

The disclosure, here, is that anyone can read private messages. Oh, and also edit posts.

SrslyJosh2• 4 years ago

Unless a service or protocol provides end-to-end encryption, you should not use its messaging features for anything truly sensitive.

And no, this is not equal. The Hive authors seem to have completely failed to implement authorization for their API, allowing (it seems) anyone with a valid auth token to make a request as any other user, granting everyone access to everyone else's data.

This is a "car company doesn't know what seat belts are" level of incompetence.

dncornholio3• 4 years ago

Well.. That's an understatement.

culanuchachamim• 4 years ago

Slightly off topic:

In the video of the post you can see an option of run a script in an iPhone.

What's that option? It's really an iPhone? What are the capabilities of that functionality?

Apocryphon2• 4 years ago

Woah so it has MySpace aspects

Kiro4• 4 years ago

What do you mean? iPhone is MySpace?

djcannabiz• 4 years ago

its with the shortcuts app. you can make little actions that appear in the share menu. I have one for downloading videos from twitter for example. It’s pretty limited in what it can do, but ive seen some cool shit people have made with it

nicwolff• 4 years ago

I once needed to download PDFs from emails, and then post just one page from each to a Web form – and all I had was an iPhone and 3G at a Caribbean beach bar. Shortcuts are less limited than I thought!

thebradbain• 4 years ago

A twitter vid downloaded shortcut is awesome, did you make it yourself or is it generally available?

toofy2• 4 years ago

yeah, shortcuts are insanely underrated.

bevenky• 4 years ago

Would love to see insights on how https://www.kooapp.com/ is?

random314• 4 years ago

It's a right wing Twitter for India.

jacooper2• 4 years ago

I wanted Mastodon to replace Twitter so we can finally see a mainstream Federated social media, to break free of corporate control over social expressions.

But with the Hive there is nothing unique, its a Twitter clone, which doesn't offer any technical or operational benefits, and also no major features.

if we are still going to use a centralized network, might as well just continue using Twitter, a network with an existing social circle.

stolen_biscuit• 4 years ago

The problem of Twitters ownership and moderation remains

jacooper2• 4 years ago

As if Hive is going to be any better?

pmarreck• 4 years ago

What's the "problem"?

dcow• 4 years ago

I thought that had been solved recently, no?

concordDance• 4 years ago

Is this about Trump, Kanye and the Babylon Bee being unbanned?

dom96• 4 years ago

its a Twitter clone

Is it? From what I've seen it's more of a Instagram clone and I am stumped as to why folks are switching to it as a Twitter alternative.

linksbro• 4 years ago

Hive just shut down their entire app: https://twitter.com/TheHIVE_Social/status/159811907190799155...

riffic• 4 years ago

haha the only ethical alternative is the ActivityPub ecosystem.

If that (Mastodon or other implementations) are not good enough, make your own or get involved with the W3C to standardize AP v2.

joe_the_user• 4 years ago

Of course and ironically, I can't tell whether this is the real Twitter of Hive.

I wonder if I'll be able to determine the real Hive of Twitter if things switch.

sacrosancty• 4 years ago

Same problem their website has. And every website. You can still find out who someone is without relying on the platform to to the identity checks.

hellweaver666• 4 years ago

To be fair to them... thats a brave step for a startup to take. So many would try to stay quiet and fix the issues behind the scenes (hell, giant companies try this attempt all the time!). They made the right move here.

NB, I don't use Hive and have no interest, I moved to Mastodon because I want to be in control of my data moving forward.

rideontime• 4 years ago

it would have been brave if they'd done so when they were alerted to the issues. doing so once they've been made public? not so much.

bagels• 4 years ago

They couldn't have given them even a week before disclosing? Seems more black hat than white hat to do the disclosure this way (resulted in the app getting taken down).

toofy2• 4 years ago

After multiple attempts to contact the company we finally reached them by phone and they acknowledged the report. After multiple days and multiple reminders by us, they claimed to have fixed all issues. However multiple vulnerabilities we reported still exist...

its a bit unfair to imply they engaged in some kind of irresponsible disclosure, they haven't disclosed any of the exploits.

ThePowerOfFuet2• 4 years ago

Did you really have to add one of the internet's most-hated songs to your screen recording like it was some cheap TikTok?

gundmc• 4 years ago

Yeah, that seemed quite immature and unnecessary.

csande17• 4 years ago

Critical security vulnerability in an iOS-exclusive app? I bet they're using CloudKit and forgot to implement server-side access control. (Even Apple screws that up half the time: https://labs.detectify.com/2021/09/13/hacking-cloudkit-how-i...)

dncornholio3• 4 years ago

Wouldn't be surprised if it was just replacing a post ID in the update call to someone else's post and server thinks it's fine. Anyone investigated yet?

[edit] Just read they took the server down, we will never know now.

[edit2] Astonishing how supportive the users are. I don't think a lot of users want to understand that all their data is on the streets. It's like they're actually deciding in what they want to believe. Seems to be a trend in society.

We found critical vulnerabilities in Hive Social

Related Stories