Yik Yak Hack

http://silverskylabs.github.io/yakhak/

by yakattack • 12 years ago

230 69 12 years ago

silverskylabs.github.io

_almosnow• 12 years ago

A truly futile 'vulnerability'.

pyrois2• 12 years ago

Sorry, in what way? Because Yik Yak is pointless?

bduerst• 12 years ago

Probably because the hack is value-less.

I doubt the users find the app pointless, but there isn't much reason to steal someone's account. You can't even link it to their real name to blackmail them.

kapsteur2• 12 years ago

Like if all new social network need to be hacked before explode : Tinder : http://www.cammipham.com/tinder-hack/ WhatApp : http://techcrunch.com/2014/03/12/hole-in-whatsapp-for-androi... Snapchat : http://www.reddit.com/r/Thefappening3/comments/2j4lql/90000_...

avbor2• 12 years ago

I don't quite understand what the hack was for the Tinder one. She just optimized her profile for likes? And added a banner saying match of the day? Not the hack I was expecting.

pyre3• 12 years ago

Agreed. Seemed more like 'growth hacking' or social engineering for popularity.

kapsteur2• 12 years ago

sorry, the good link : http://www.businessweek.com/articles/2014-02-19/new-tinder-s...

nashequilibrium• 12 years ago

Don't forget the much publicized co-founder fight coered by every tech blog, deposition videos to follow.

at-fates-hands• 12 years ago

So another session hijacking hack using easily available tools?

stryan• 12 years ago

This doesn't seem like it will be too much of a practical problem. As said in the article, YikYak is mostly used on university campuses and odds are if a student is on campus they would be connected to the university wifi. From personal experience most university's use some form of WPA2-Enterprise authentication which which wireshark can't decrypt.

adamtj• 12 years ago

What about ARP spoofing? Have all wireless routers ever built somehow gotten this right?

It's my understanding that unless the wireless access point is sufficiently smart, any device on the same network can claim to be the router and your phone won't know the difference. Even if an attacking device can't passively decrypt your radio transmissions, it won't matter because the router will actively decrypt and re-encrypt your packets before forwarding them on to the attacking device.

galvan• 12 years ago

Actually, yes! *For enterprise-grade APs generally deployed at university campuses...[0] Moreover, such APs usually have methods to prevent communication between peers on the same wireless network.

[0] http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mo...

ben1040• 12 years ago

That's assuming the attacker would be a fellow student connecting to the wifi network, and not the school, who has full control of the the network beyond the access point.

I'm long out of undergrad so I've never used this app, but I've read that YikYak is at least somewhat known for controversial content regarding schools, school employees/faculty, and fellow students.

Seems like there would've been just as much, if not more, incentive for a university administrator to want to get people's post histories in order to divine who posted a particular piece of content.

saidajigumi• 12 years ago

As said in the article, YikYak is mostly used on university campuses

University campuses, where students are constantly using the free WiFi in cafes, are on private WiFi networks shared with friends, etc. Even if the University's own WiFi was magically invulnerable, there will be many associated venues ready for use of this exploit.

pyre3• 12 years ago

1. Setup an open access point in the middle of campus.

2. Give it a default name (e.g. 'linksys').

3. Capture packets.

4. Profit.

andrewjkerr• 12 years ago

YikYak is mostly used on university campuses and odds are if a student is on campus they would be connected to the university wifi

Based on some of the vague locations that Yik Yak gives with each post I'd say a little less than half are actually sent from on campus.

hayksaakian• 12 years ago

big take away: if you're using dependencies that talk across the internet, make sure they're ALSO using HTTPS

smt885• 12 years ago

There's genuinely no excuse for Flurry (or any other vendor) to have an API that is not secured with HTTPS by default. I can't think of any reason other than stupidity or laziness, and those aren't excuses.

This is especially true of Flurry, which is tailored for connections directly from devices.

johnnycash2• 12 years ago

Sacrificing users' security just to load ads and generate revenue says a lot about this company's ethics.

chrisrogers• 12 years ago

to me it speaks more about poor security auditing. Treating the User ID as a public key instead of a private one to me signals lax security policy.

smt885• 12 years ago

Client-side code (even native apps) must be considered public. That means your API is also publicly discoverable.

A user ID is fine to use as a public key, but it must be paired with something private. Generally some sort of unique, crypographically-secure auth token is fine when combined with forced HTTPS connections.

tedks5• 12 years ago

Do you know anything about Yik Yak? It doesn't have ads, at least not on Android.

johnnycash2• 12 years ago

The article says they temporarily disable HTTPS to make a call to Flurry, which is an advertising/analytics company. They must be accessing the analytics side.

ForHackernews• 12 years ago

I don't see how this matters much. YikYak is anonymous, so if you stole my "account", all you'd get it my yakkarma. Potentially having a history of past yaks would reveal something about the user (not in my case).

Yadi• 12 years ago

Oooow snap!

fataliss• 12 years ago

I still don't quite get why people would want to disclose real private message anonymously on the internet. It should be common knowledge that nothing is ever 100% secure. It's all about the amount of efforts people are ready to put in order to hack it. For me it's a pointless app, with a hack that require way too much effort to get such a small value. But that is nonetheless a vulnerability and I agree that this reveals some neglecting from Yik Yak engineers. It's a big fail for them to be advertising privacy when they don't even check the security of the 3rd party tools they include in their flow. This should serve as a reminder for the rest of us engineers to never blindly trust 3rd party tools and always cover your ass! Thanks for sharing :)

unknownian• 12 years ago

real private message

That's not the point of Yik Yak. You're just broadcasting to the community, and rarely is something super incriminating posted, at least in my college's community.

TazeTSchnitzel4• 12 years ago

Surprising they only used the User ID for auth. Surely you'd also generate a private key on the device and either use it as a password, or do public key cryptography to authenticate?

By the sounds of the Wikipedia article the developers were novices, however, which might be why they didn't think of doing this.

sssss3333• 12 years ago

There's no visible usernames in the app. I'm not sure what good taking over someone's account would do you.

smt885• 12 years ago

1. Hack someone in your office

2. Hack someone in your home (one of your kids for example)

3. Hack someone in a coffee shop

Generally, when someone thinks they're anonymous and they aren't, bad things are going to happen.

kibibu• 12 years ago

Did you not read the part in the article about de-anonymizing user ids?

DonHopkins• 12 years ago

Delete something they posted about you.

randyrand• 12 years ago

If the userID is long enough (it is) and all the communication is https (it almost is), then you dont need anything else.

It's not the most secure, but it's actually a pretty elegant solution. The userIDs are never used anywhere else, just as a cookie session ID essentially. They should have had them expire though. Your public key solution is definitely more secure and would accomplish hthat.

TazeTSchnitzel4• 12 years ago

Was this responsibly disclosed? It doesn't seem to say whether it was. I'm fearing the worst.

fiberloptic• 12 years ago

Does the website disclose who is posting what?

Turnabout is fair play.

personjerry• 12 years ago

So you can MITM and take over someone's anonymous account, so what? There's no associated personal information, no logins or anything, so you wouldn't even know who owns that account, let alone passwords or emails.

You can view all the posts they've made and make a reasonable guess as to which person it was, I suppose, but that seems like a pretty flimsy argument.

smt885• 12 years ago

See my post above. You can hack someone geographically near you (i.e. in the same room or building). If you know the person, it wouldn't be hard to figure out who they are.

mikeash2• 12 years ago

Being able to link an account to a local IP address and MAC address would probably let you deanonymize the account. At the least, you could find the wifi MAC and then walk around measuring signal strength until you found the right table.

marco12• 12 years ago

They're hosted on AWS and probably using server name indication (SNI) for their SSL. Android's version of HttpClient is outdated (and won't be upgraded [1]). This is why SNI is not supported in that library and this may be why they chose to use some dirty hacks [2] so that they can use SSL with HttpClient.

[1] http://android-developers.blogspot.de/2011/09/androids-http-... [2] https://developer.android.com/training/articles/security-ssl...

marco12• 12 years ago

"To perform user-based analytics, Flurry needs some way of keep tracking of individual users. Yik Yak gave them the only user identification they have available: the userID."

And, while reading the article, we all probably were: "No, please, I hope they didn't do what I'm afraid is following now ..."

andrewchambers• 12 years ago

They could just one way hash the userid then send that to the analytics service.

skrebbel• 12 years ago

What the hell? All that talk, plus a toolkit download, and not a word about responsible disclosure?

I'm not sure if I'd ever want SilverSky (the firm behind this) to have my money.

areohbe• 12 years ago

Silversky disclosed this to the Yik Yak team on December 2nd.

The original source appeared on their blog on Friday, December 3rd after Yik Yak had released an update to the App Store.

https://www.silversky.com/blog/yik-hak-smashing-the-yak

UUMMUU• 12 years ago

This is the app that all those highschool kids almost killed themselves over right? Hack away, I would say responsibly disclose but this app only hurts people.

brotoss• 12 years ago

Would it be illegal to use this and post photos of the idiots using this app on my campus with their associated comments?

Yik Yak Hack

Related Stories