Comments on: Google Urchin password theft madness http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/ Information Security Think Tank Sat, 30 Aug 2008 11:03:20 +0000 http://wordpress.org/?v=2.6.1 By: Operation n » XSS - Proof of Concept http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-64037 Operation n » XSS - Proof of Concept Fri, 02 Nov 2007 07:07:00 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-64037 [...] to redirect to the attacked site) But I mentioning it now because there has been discussions about this already on gnucitizen. This talks bout another a way to send information to a foreign site without [...] [...] to redirect to the attacked site) But I mentioning it now because there has been discussions about this already on gnucitizen. This talks bout another a way to send information to a foreign site without [...]

]]> By: Adrian Pastor http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-53533 Adrian Pastor Fri, 28 Sep 2007 21:56:16 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-53533 Hey MustLive, Thanks for your kind words, very much appreciated! I did read about the unauthenticated access issue and left my comments here: http://ha.ckers.org/blog/20070823/xss-and-possible-information-disclosure-in-urchin/ <blockquote><p>Back in July, when I was searching some examples in Google also noticed that some sites have the Urchin stats wide open, but I thought this was a configuration problem as opposed to a bug.</p> <p>Are you guys sure there is a <q>authorization bypass hole</q>?</p></blockquote> MustLive, is this a 100% verified issue? Have you guys replicated this in a lab environment? I can't make it work on my test installation. Hey MustLive,

Thanks for your kind words, very much appreciated!

I did read about the unauthenticated access issue and left my comments here: http://ha.ckers.org/blog/20070.....in-urchin/

Back in July, when I was searching some examples in Google also noticed that some sites have the Urchin stats wide open, but I thought this was a configuration problem as opposed to a bug.

Are you guys sure there is a authorization bypass hole?

MustLive, is this a 100% verified issue? Have you guys replicated this in a lab environment? I can’t make it work on my test installation.

]]> By: MustLive http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-53502 MustLive Fri, 28 Sep 2007 20:14:48 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-53502 Hi Adrian! No need to paste your words, I read your whole post carefully ;-). I understand that you was first who found this hole and I believe you (and Google also know that you was first who tell them about this XSS). Some people who found this hole after you outstrip you with disclosure, but you was the first discoverer, so you have respect of me and security community. I understand you with this situation, when other guys officially disclosed your hole before you. This incidents sometimes happens in webappsec world. I regularly have such experience, when people disclosing holes which I first discover before me, or when people disclosing holes many months after my disclosure. What I wrote in my previous comment (and what I wrote at my site), that there is another hole in Urchin. It is Authorization bypass vulnerability (which as I know was found by RSnake and you didn't mention it in your post). This one gives possibility to enter into account without any login and password. It is also interesting hole as your XSS. Hi Adrian!

No need to paste your words, I read your whole post carefully ;-). I understand that you was first who found this hole and I believe you (and Google also know that you was first who tell them about this XSS). Some people who found this hole after you outstrip you with disclosure, but you was the first discoverer, so you have respect of me and security community.

I understand you with this situation, when other guys officially disclosed your hole before you. This incidents sometimes happens in webappsec world. I regularly have such experience, when people disclosing holes which I first discover before me, or when people disclosing holes many months after my disclosure.

What I wrote in my previous comment (and what I wrote at my site), that there is another hole in Urchin. It is Authorization bypass vulnerability (which as I know was found by RSnake and you didn’t mention it in your post). This one gives possibility to enter into account without any login and password. It is also interesting hole as your XSS.

]]> By: A rough week for Google security — Security Bytes http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-53244 A rough week for Google security — Security Bytes Fri, 28 Sep 2007 00:10:37 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-53244 [...] An Urchin Login XSS disclosed by GNUCITIZEN’s Adrian Pastor, which could be exploited to compromise local Google [...] [...] An Urchin Login XSS disclosed by GNUCITIZEN’s Adrian Pastor, which could be exploited to compromise local Google [...]

]]> By: [SSD] Security & Development Blog » Colección de vulnerabilidades XSS en aplicaciones de Google http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52999 [SSD] Security & Development Blog » Colección de vulnerabilidades XSS en aplicaciones de Google Thu, 27 Sep 2007 03:19:39 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52999 [...] se mencionan otras dos vulnerabilidades XSS ([1], [2]) dentro de las páginas de Picasa Web y las que utilizan el software instalable de [...] [...] se mencionan otras dos vulnerabilidades XSS ([1], [2]) dentro de las páginas de Picasa Web y las que utilizan el software instalable de [...]

]]> By: eBusiness Industry News » Blog Archive » Bullseye on Google: Hackers expose holes in GMail, Blogspot, Search Appliance http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52948 eBusiness Industry News » Blog Archive » Bullseye on Google: Hackers expose holes in GMail, Blogspot, Search Appliance Wed, 26 Sep 2007 19:07:11 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52948 [...] bug in Google’s Urchin Analytics service that can be exploited to steal user credentials. An explanation of this vulnerability has been published by Adrian [...] [...] bug in Google’s Urchin Analytics service that can be exploited to steal user credentials. An explanation of this vulnerability has been published by Adrian [...]

]]> By: Linux-OS » Semana negra para Google http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52889 Linux-OS » Semana negra para Google Wed, 26 Sep 2007 12:45:32 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52889 [...] Adrian Pastor, de GNU Citizen, publica una nueva vulnerabilidad XSS explotable (robo de contraseñas) en la página de login de Google Urchin Web Analytics 5, es [...] [...] Adrian Pastor, de GNU Citizen, publica una nueva vulnerabilidad XSS explotable (robo de contraseñas) en la página de login de Google Urchin Web Analytics 5, es [...]

]]> By: DigitMemo.com » Hackers expose holes in GMail, Blogspot, Search Appliance http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52689 DigitMemo.com » Hackers expose holes in GMail, Blogspot, Search Appliance Wed, 26 Sep 2007 00:09:38 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52689 [...] bug in Google’s Urchin Analytics service that can be exploited to steal user credentials. An explanation of this vulnerability has been published by Adrian Pastor. From: DigitMemo.com [...] [...] bug in Google’s Urchin Analytics service that can be exploited to steal user credentials. An explanation of this vulnerability has been published by Adrian Pastor. From: DigitMemo.com [...]

]]> By: Hackers expose holes in GMail, Blogspot, Search Appliance | xMoDx http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52679 Hackers expose holes in GMail, Blogspot, Search Appliance | xMoDx Tue, 25 Sep 2007 23:23:17 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52679 [...] bug in Google’s Urchin Analytics service that can be exploited to steal user credentials. An explanation of this vulnerability has been published by Adrian [...] [...] bug in Google’s Urchin Analytics service that can be exploited to steal user credentials. An explanation of this vulnerability has been published by Adrian [...]

]]> By: Ryan Naraine’s Zero Day mobile edition http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52606 Ryan Naraine’s Zero Day mobile edition Tue, 25 Sep 2007 20:06:37 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52606 [...] bug in Google’s Urchin Analytics service that can be exploited to steal user credentials. An explanation of this vulnerability has been published by Adrian [...] [...] bug in Google’s Urchin Analytics service that can be exploited to steal user credentials. An explanation of this vulnerability has been published by Adrian [...]

]]> By: Adrian Pastor http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52434 Adrian Pastor Tue, 25 Sep 2007 10:11:03 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52434 Hi MustLive: Copied and pasted from this very same post: <blockquote>I reported the issue to Google back on Jul 25 and was confirmed by their security team. They are now working on a fix. My original plan was to publish this info after a fix would be released. However, the issue has also been found by other folks about a month ago.</blockquote> In other words, I do mention that it's been publicly made a month ago by others, but ALSO that I reported it to Google 2 months ago and that I was waiting for them to fix it BEFORE making it public. Hi MustLive:

Copied and pasted from this very same post:

I reported the issue to Google back on Jul 25 and was confirmed by their security team. They are now working on a fix. My original plan was to publish this info after a fix would be released. However, the issue has also been found by other folks about a month ago.

In other words, I do mention that it’s been publicly made a month ago by others, but ALSO that I reported it to Google 2 months ago and that I was waiting for them to fix it BEFORE making it public.

]]> By: djteller http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52429 djteller Tue, 25 Sep 2007 10:00:23 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52429 Nice work man. Sorry about the credit issue, but dont worry, you got our respect. Nice work man.
Sorry about the credit issue, but dont worry, you got our respect.

]]> By: MustLive http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52310 MustLive Tue, 25 Sep 2007 01:17:27 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52310 Adrian. As I wrote at my site month ago (http://websecurity.com.ua/1283/) about this XSS hole in Urchin, RSnake already wrote about this hole. Like you also mentioned about. But as I and RSnake wrote, there is not only XSS, but also Authorization bypass vulnerability in Urchin. Which give possibility to look at statistic without any login and password! <blockquote>I know that you’re sick of XSS PoCs that only open alert boxes.</blockquote> I'm not, I like alert boxes :-), especially alert(document.cookie). Nevertheless, man, nice XSS PoCs and video ;-). Adrian.

As I wrote at my site month ago (http://websecurity.com.ua/1283/) about this XSS hole in Urchin, RSnake already wrote about this hole. Like you also mentioned about. But as I and RSnake wrote, there is not only XSS, but also Authorization bypass vulnerability in Urchin. Which give possibility to look at statistic without any login and password!

I know that you’re sick of XSS PoCs that only open alert boxes.

I’m not, I like alert boxes :-), especially alert(document.cookie).

Nevertheless, man, nice XSS PoCs and video ;-).

]]> By: [SSD] Security & Development Blog » Semana negra para Google http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52261 [SSD] Security & Development Blog » Semana negra para Google Mon, 24 Sep 2007 22:15:31 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52261 [...] Adrian Pastor, de GNU Citizen, publica una nueva vulnerabilidad XSS explotable (robo de contraseñas) en la página de login de Google Urchin Web Analytics 5, es [...] [...] Adrian Pastor, de GNU Citizen, publica una nueva vulnerabilidad XSS explotable (robo de contraseñas) en la página de login de Google Urchin Web Analytics 5, es [...]

]]> By: DigitMemo.com » Multi Google Security Holes Revealed http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52246 DigitMemo.com » Multi Google Security Holes Revealed Mon, 24 Sep 2007 21:14:01 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52246 [...] , The Urchin Login XSS, another Google-outsourced vulnerability, could compromise local Google Analytics installations. [...] [...] , The Urchin Login XSS, another Google-outsourced vulnerability, could compromise local Google Analytics installations. [...]

]]> By: Passwortklau mit XSS und “autocomplete passwords” » darkster.de http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52215 Passwortklau mit XSS und “autocomplete passwords” » darkster.de Mon, 24 Sep 2007 18:47:40 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52215 [...] Madness? This is gnucitizen.org. [...] [...] Madness? This is gnucitizen.org. [...]

]]> By: hackademix.net » GoogHOle (XSS pwning GMail, Picasa and almost 200K customers) http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52180 hackademix.net » GoogHOle (XSS pwning GMail, Picasa and almost 200K customers) Mon, 24 Sep 2007 17:15:46 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52180 [...] after I released the first version of article, I read of another Google-outsourced vulnerability: Urchin Login XSS disclosed by GNUCITIZEN’s Adran Pastor, which could compromise local Google Analytics [...] [...] after I released the first version of article, I read of another Google-outsourced vulnerability: Urchin Login XSS disclosed by GNUCITIZEN’s Adran Pastor, which could compromise local Google Analytics [...]

]]> By: RobotSkirts » Blog Archive » Google Urchin password theft madness http://www.gnucitizen.org/blog/google-urchin-password-theft-madness/#comment-52175 RobotSkirts » Blog Archive » Google Urchin password theft madness Mon, 24 Sep 2007 16:41:04 +0000 http://www.gnucitizen.org/blog/google-urchin-password-theft-madness#comment-52175 [...] Google Urchin password theft madness XSS attack that steals autocomplete information from the login screen before the user even clicks login. [...] [...] Google Urchin password theft madness XSS attack that steals autocomplete information from the login screen before the user even clicks login. [...]

]]>