Disqus cracked – Security flaw reveals users’ e-mail addresses

http://cornucopia-en.cornubot.se/2013/12/flash-disqus-cracked-security-flaw.html

by SuperChihuahua • 13 years ago

159 87 13 years ago

cornucopia-en.cornubot.se

ddebernardy2• 13 years ago

Yawn. A rainbow table can be used to determine str in MD5(str). News at 11…

Sae5waip5• 13 years ago

The news is that Disqus is relying on that.

ddebernardy2• 13 years ago

So does Automattic with gravatars (on nearly 20% of the internet, no less), and pray tell how many other companies that use md5(email) as a unique ID for a reason or another. Duh! What were they thinking!

nallerooth• 13 years ago

The fact that md5 hashes of email addresses can be brute forced is nothing new. This has been pointed out for years, concerning services like gravatar. The only thing which is important, is that Expressen/Researchgruppen believes that they have the right to exploit Disqus' service in order to "make the news".

Sae5waip5• 13 years ago

Why don't/shouldn't they?!

Theres a security problem with Disqus.

Apparently it (genereal technique) is "old news"

Apparently Disqus doesn't care enough to fix it.

Demonstrating the attack may be the only way to get them to care.

downer90• 13 years ago

Anything requiring third-party cookies, AND requesting an e-mail address not only stinks of spam-oriented advertising revenue, but also total disregard for user security. Even more telling were the options to sign in with services like Facebook Oauth.

So from the beginning, I think it was always obvious that Disqus had no interest beyond the bare minimum in casually protecting user privacy. This prompted me to avoid ever providing Disqus with any kind of serious e-mail address. Looks like my instincts served me well.

eli• 13 years ago

You think Disqus is selling your email address to spammers?

eXpl0it3r• 13 years ago

The article is a bit miss leading. The so called security flaw does not reveal the e-mail address directly, but a MD5 hash of it. Sure it can be cracked, but it doesn't mean that it will get cracked.

Sae5waip5• 13 years ago

Actually, yeah, it will be cracked, by someone.

And E-Mail-addresses aren't passwords; trying a few hundred variations for each firstname for each lastname is perfectly feasible and should crack a nice percentage of these hashes.

hrrsn• 13 years ago

My email is firstname@companyname.co.nz (I have a few of these at different companies). I'm fairly confident this isn't going to be cracked any time soon by random MD5 hashing.

(of course, my real name can be extrapolated from my HN username)

__pThrow2• 13 years ago

In all our worry about NSA taps, the simple fact is that gravatar and now disqus allows anyone NSA, your health insurance company, groups who dislike your group, etc., to track your blog comments, help desk comments, any comment you make around the net.

Your comments to gay rights groups, anti-gay rights groups, cancer support groups, aids support groups, abortion groups, democratic politics, tea party groups, gun rights groups, doctors offices, anyone using wordpress as a front end group.

Anyone can do this with a simple search engine they create, and apparently we don't care because gravatar was setup by a silicon valley favorite and is now owned by Wordpress who was informed of this years ago and refused to consider it a privacy leak. And anyway we like them cutsie cartoon avatars.

Anyone can do this with a search engine that maps pages to md5 hashes and vice versa and either a rainbow table of email addresses, or even easier, a list of your customer's email addresses, because let's see if any of our customers have health problems they didn't disclose.

lmm2• 13 years ago

Any comments you make under your email address are attributable to that email address. Duh. The whole point of gravatar and disqus is to make it clear that your comments on a bunch of different sites are from the same person.

If you don't want a particular comment associated with your name or email, why would you ever fill in that name or email when commenting?

Sae5waip5• 13 years ago

From the same person, but not from that email address. Bad idea, but as per the article people expect these posts not to be linkable to their e-mail address. Why? Well, obviously, because that's the way Disqus works "usually".

__pThrow2• 13 years ago

If I go to comment at a wordpress site it says this:

"Email (required) (Address never made public)"

MD5 leaks of my email address into web pages is in fact making my address public.

Hey lmm, duh, when you make a comment under a different name but with the same email address that you think is anonymous at your local hiv testing site, you may not expect that your insurance company can track that down because wordpress has been leaking your md5 address all over the place.

saraid216• 13 years ago

Really what we should be doing is explaining to people that "foo@example.com" is a valid email address and that they should use it everywhere.

I am foo@bar.com. I don't know who owns that email, but I want to preemptively apologize to them about Disqus comment responses they've received.

dutchbrit• 13 years ago

Old olllddd news, almost every Wordpress blog uses Gravatar, same issue...

subsystem2• 13 years ago

So why do you feel compelled to post when you know what you are saying is old news? You just adds to the noise and make it off putting for anyone else to post that actually knows about this event including your obvious point.

nkuttler• 13 years ago

Now I'm confused.. why do you feel compelled to reply? You just add to the noise.

Asdfjgori5• 13 years ago

Get 150 million e-mail addresses from Adobe hack. Match vs Disqus users. Profit.

gabriel344• 13 years ago

Even better, you can be certain a great number of users reuse their password

Asdfjgori5• 13 years ago

True. A percentage of the union of Adobe and Disqus users will use the same password for both services.

f0552• 13 years ago

I don't get it, if your email address is so private then why you share it with 3rd parties? Also, why would your email address be so private if the spam filters are so efficient nowadays, what's the harm in having a public email address? Please enlighten me.

pathy2• 13 years ago

It gets a bit awkward when you comment on racist/anti-immigration websites with your (at least semi public) email while you represent a far right party that officially has a zero tolerance on racism.

The party has its roots in the skinhead/neo-nazi organizations and they have been trying to shake that image problem for quite some time now. To be fair, putting on suits has helped them.

f0552• 13 years ago

Yeah well, the person has himself to blame. Either be identifiable or anonymous. Don't use private email and expect to be untraceable. That's just mad.

iamabhishek• 13 years ago

you are absolutely right, we have public email addresses, and also the spam filters. But then still, information needs to be protected. There are people who dont want their email addresses public or in some list which is being sold over and over again to marketing companies which then flood your inbox with spams. It is irritating at times even if there's spam filters.

darkarmani4• 13 years ago

I don't get it, if your email address is so private then why you share it with 3rd parties?

How would you use it otherwise? My backyard is private, but I share it with a few 3rd parties. That doesn't mean i intent to share my backyard with the entire world.

There is an element of trust with particular 3rd parties that is being violated. Why is that so hard to understand?

tedunangst• 13 years ago

The address of your backyard is not private.

reginaldjcooper• 13 years ago

Why share it with 3rd parties? Because that's the typical method of creating an account and managing it in case you forget your password and they will typically claim that they aren't going to share it with anyone and the cost of finding an anonymous mail that they will accept is quite a bit of time. (I typically do not use my email to sign up for anything.)

Why not public? I guess it's fine if everyone knows it assuming a perfect spam filter (they aren't perfect btw) but I don't want it to be public knowledge what websites I use and what I say on those sites. Non-sinster example; I could be publicly discussing a sexual encounter and just not want the whole world to know (non-psuedonymously) that I did that.

frederickf• 13 years ago

I think the point isn't that the emails were exposed so much as the exposure of the emails allowed the identity of commentors to be revealed.

cubehouse• 13 years ago

MD5 hashes of emails is very common practice for Gravatar etc. - although it's fairly sucky, I'm assuming this is in the API specifically for things like showing Gravatar images.

I reported a username -> plaintext email vuln to Disqus earlier this year and they were very prompt in patching it, I wouldn't criticize them for this at all as this a very common issue across most blog comment systems.

Would be nice to change how Gravatar works, but it's fairly fundamental. I think if you want your email to be private you should probably be registering temporary ones or using the + aliases like gmail offers to avoid these kinds of hash-cracking attacks.

amckenna• 13 years ago

Another solution would be for these services to use something with a greater work factor than MD5. When a typical user can brute force MD5s at a rate of 8.5 billion per second with AMD HD7970 graphics card then it's time to use a different hashing algorithm. Something like scrypt or bcrypt with a larger work factor would make these attacks much harder and more expensive, while leaving the fundamentals of the system the same.

http://hashcat.net/oclhashcat/ https://www.tarsnap.com/scrypt.html https://en.wikipedia.org/wiki/Bcrypt

gabriel344• 13 years ago

So, what would suffice to maintain anonymity AND the ability to send the user email notifications?

I'm guessing Hashing (not MD5 though) + Salting + throwing away the salt and bruteforcing it every time you need the plain email (you will lose the option to mass mail your users)

Even then the whole concept of anonymity AND email bound account seems kind of silly. Even if the user uses a secondary email address just for this, he still has to trust the email provider (and if he uses a throwaway, what is the point of collecting it anyway?)

This crack is proof that services that provide a fake sense of anonymity can do a lot of harm.

eterm• 13 years ago

Surely any hashing would be susceptible?

Even a slower or more "secure" hash wouldn't help much, because I can take your starting known email address and find comments you have made. i.e. I can start with "bill@example.com", slowly hash that to 901e54d1 and then search google for 901e54d1 to find comments you've made.

Speed isn't a big deal if I'm interested in attacking specific subsets of emails. (Which could still be a "large" set in a real world sense.)

As long as the hashing algorithm is known then it would be weak to finding comments made by known authors. If the hashing algorithm is unknown then it falls under security by obscurity.

So is there any way to implement a decentralised pseudonymous but ID-based system where the ID is tied to email but cannot be generated from email (or rather is generated from email but with some added entropy that prevents going in either direction in the future.).

gabriel344• 13 years ago

you could salt the hash twice. One (large) you store the other you throw away. This way to compromise a specific account you would have to steal it's stored hash. If there was a leak of the hashes you would need to bruteforce all the hashes which were thrown away

jessaustin5• 13 years ago

In general, what you're asking about is called a "salted hash". I don't understand enough about Disqus's system to say it would definitely have prevented this vulnerability.

darkarmani4• 13 years ago

A salted hash only slows down brute-force attacks and dictionary attacks. The salt is still stored with the hash, so you could still eventually match the email address with the hash. Instead of hashing each email address once and comparing it with all of your collected hashes, you'd have to hash each email address using every salt until you found a match.

RyanZAG• 13 years ago

It's possible to prevent this. Disquis could create a service limited to their network that could store a unique id for each registered email address and hashed with the email, or used instead of the hash. This obviously adds additional computation, latency and storage to their system though so it's far from free but it is definitely possible to prevent this type of hash lookup.

im3w1l2• 13 years ago

I think encryption would be the correct way, since you don't want people to be able to compute either plaintext from ciphertext or ciphertext from plaintext. You would still have to provide an encryption oracle, which would allow bruteforcing, but that could be rate limited.

Asdfjgori5• 13 years ago

Researchgruppen seems to be in violation of the Disqus terms of service by harvesting personal information and also disclosing this in other mediums.

oneeyedpigeon• 13 years ago

So what? I doubt they're bothered if Disqus bans them from using their service.

kmfrk• 13 years ago

Glad I use separate e-mail addresses for signing up to sites and for personal correspondence.

jstalin2• 13 years ago

Another reason to not use your real name or email address when commenting across the web.

vocino• 13 years ago

Or you know just be a decent person and not post things you wouldn't say in person yourself.

TallGuyShort• 13 years ago

Yeah - people have never been persecuted for who they are in person.

defen• 13 years ago

Common Sense, The Federalist Papers, Candide ...

jstalin2• 13 years ago

Things like... I think gays shouldn't be beaten up and jailed in Russia for engaging in gay "propaganda?" Things that people who are under the threat of being beaten up and jailed for saying fear?

draugadrotten• 13 years ago

If a political organisation was revealing the identities behind anonymous speech on a jewish forum, the world would be up in arms. If the identities on a gay board was published, Obama himself would be apologising. Now the identities of thousands of people commenting on politics in Sweden was revealed, and it's OK because "they" are the bad guys, says the extreme left organisation Researchgruppen.

The slippery slope is

trapezor• 13 years ago

Well yes, because of hate speech and potential violence...

subsystem2• 13 years ago

Press freedom generally trumps privacy, as it should.

knowtheory• 13 years ago

Being born into a jewish family isn't a choice. Being gay isn't a choice.

Being politically affiliated with hate speech IS a choice.

That is some straight up false equivalency bullshit.

robomartin2• 13 years ago

The British probably thought those behind the movement that ultimately resulted in the United States were engaging in hate speech. Be careful not to use a tinted lens to evaluate the world. We all do it. I am not critical of your statement. I am merely pointing out that dissenting points of view throughout history have often met with push-back. Very often, years later, those responsible for the "hate speech" were recognized as being at the root of positive world-changing developments. Imagine the people who dared to engage in "hate speech" against the flat earth and geocentric dogma, voting rights, slavery, etc.

I am disagreeing with you on one point. Being Jewish is a choice, just like being Christian is a choice. I was born into a family, like most, with generations of religious belief. I, however, am an atheist. You don't have to be a Jew. You can have jewish culture in your life, respect it and enjoy it. That does not mean you have no choice but to also be religious. That part is a choice. Just as it is for anyone from any other religion.

bzbarsky2• 13 years ago

Being born into a jewish family isn't a choice.

The normal US point of view is that "Jewish" is a religion, not an ethnicity, hence is a choice.

That point of view is not universally shared, of course.

drone• 13 years ago

Hate speech is just the speech that the majority has determined that they don't want to hear, and clearly, in some countries, are willing to exercise state violence upon those who commit it.

The problem with making speech legal or illegal based on popular opinion of it, is that one IS perfectly capable of engaging in hate speech without choosing to do so. What happens when what I said online two years ago becomes hate speech tomorrow? Do I need to make sure I go scrub all of my past speech before anyone finds out and sends me to jail?

Furthermore, one "chooses" their future course, and whether they want to self-identify with one group more than another. To claim otherwise is to deny any semblance of free will. I know many people who choose to identify with the gay community that aren't gay, and many who choose to NOT identify with the gay community who are gay.

False equivalency rains down wonderfully on the head of a man imprisoned for speaking his mind. You can tell him all day how he chose to be in jail.

gamblor956• 13 years ago

The difference is that in Europe, free speech is not as expansive as it is in the U.S. Hate speech is defined more broadly east of the pond, and is generally a crime in itself in many European nations. In contrast, in the U.S. only hateful acts are crimes (speech itself is not enough), though hate speech can be a a tort (a private action, i.e., for emotional distress).

The crack was done in cooperation with the Bonnier Group tabloid Expressen, in order to reveal politicians commenting on Swedish hate speech-sites.

Exposing politicians is a time honored practice in all countries and across all ideologies. It's possible that the hacking is still a crime in Sweden, regardless of the motives. No one is defending it--you seem to have done that on your own, as the linked article certainly does not.

anilshanbhag• 13 years ago

Where does one get the dataset of email id's of Adobe users ?

antonpug• 13 years ago

Nice. Glad I decided against using Disqus for my site.

sneak• 13 years ago

Y'all seem to be forgetting that this isn't random ascii string bruteforcing: you start with a list of known email addresses collected from other places or bought from spammers, then you hash all those, and you see which ones match.

stonemetal• 13 years ago

Why MD5 the email addresses? If you just need a unique id for a user, why not use a GUID or something that isn't traceable from public information?

Disqus cracked – Security flaw reveals users’ e-mail addresses

Related Stories