Tuesday, December 10, 2013

FLASH: Disqus cracked - security flaw reveals user e-mail addresses

The Swedish company Resarchgruppen has cracked the Disqus commenting system, enabling them to identify Disqus users by their e-mail addresses. The crack was done in cooperation with the Bonnier Group tabloid Expressen, in order to reveal politicians commenting on Swedish hate speech-sites. (Bonnier/Expressen, article in Swedish)

The crack uses a serious security flaw in the Disqus API:s, enabling the extraction of MD5 hashes of user e-mail addresses. By matching the MD5 hashes by brute force vs an e-mail database users are identified.

Example of the attack vector, as revealed by Twitter user chmod007, security engineer David Remahl.
https://disqus.com/api/3.0/users/details.json?user=username:USERNAME&api_secret=secret
The Disqus commenting system has over 50 million users world wide and is used by 750 000 media sites and blogs (Wikipedia). They are no longer necessarily anonymous.

Update: Looking for 150 million e-mail addresses to match vs Disqus accounts? Download the 150 million user e-mails from the intrusion into Adobe's user database.

Update 2: Researchgruppen and possibly Expressen might be in violation of the Disqus terms of service, which they probably have to agree to in order to access the API. See below.
"Service Rules. You agree not to engage in any of the following prohibited activities: (i) copying, distributing, or disclosing any part of the Service in any medium, including without limitation by any automated or non-automated “scraping” except for uses allowed under the “Feed and API” section below; [...](vii) collecting or harvesting any personally identifiable information, including account names, from the Service; (viii) uploading, posting, transmitting, sharing, storing or otherwise making publicly available on the site, or other channels, any private, personally identifiable information of any third partyincluding, but not limited to: addresses, phone numbers, email addresses, Social Security numbers and credit card numbers; [...] (xii) accessing any content on the Service through any technology or means other than those provided or authorized by the Service or Disqus’ written permission;"

30 comments:

  1. "The crack was done in cooperation with the Bonnier group tabloid Expressen, in order to reveal politicians commenting on Swedish hate speech-sites".

    Nog för att jag ogillar den orgie i rasism som förekommer på Internet ibland, men, hur kan det vara lagligt av AFA/Researchgruppen/Bonnier att utföra dataintrång i syfte för att åsiktsregistrera obekväma svenska politiker? Man behöver väldigt lite fantasi för att ana ljusskygga krafter i rörelse inför valet nästa år. Ett solklart fall för säkerhetspolisen kan man tycka.

    ReplyDelete
    Replies
    1. Detta var väll knappast något som AFA låg bakom? Detta är inte heller åsiktsregistrering, utan detta är granskning av folkvalda politiker. Som politiker bör man kunna stå för sina åsikter och inte gömma dig bakom pseudonymer.

      Delete
    2. Det har börjat dyka upp berättelser om att de gått till privatpersoner och försökt intervjua dom också, något som definitivt kan räknas som åsiktsregistrering.

      Delete
    3. "Detta var väll knappast något som AFA låg bakom?"

      Jo. Researchgruppen hette tidigare AFA Dokumentation.

      Delete
  2. So this isn't a way spammers could harvest email addresses, it's merely a way of correlating comments a user made to their email address if the you know their email address already. Not such a big deal for most disqus users, but a bit of a problem if you were hoping to be anonymous like these swedish politicians.

    ReplyDelete
    Replies
    1. Yes. You have to have a list of e-mail addresses to match vs MD5 hashes. For example the 150 million Adobe user e-mail addresses. Disqus cannot be considered anonymous, unless you use a one-off e-mail address for registration.

      Delete
  3. Åsiktsregistreringen skedde på Disqus och liknande sidor där personerna av fri vilja sparar sina åsikter så att de kan presenteras för allmänheten. Att någon gör sig besväret att samla in allt det här är ungefär lika upprörande som att ledarsidorna i sverige åsiktsregistreras av kungliga biblioteket som får pliktexemplar av allt dom publicerar och sedan sparar dom.

    Något dataintrång rör det sig inte om, det går att fråga Disqus efter info om en användare och du kommer få ett svar du sedan kan jämföra med en lista av kända personer du misstänker kan vara användaren.

    Det du invänder emot är att användare har avanonymiserats, vilket man kan ha blandade känslor kring, men en del av komentarerna på tex avpixlat är ju brottsliga så att koppla användarna till personer kan ju ses som ett medborgaringripande.

    ReplyDelete
    Replies
    1. Idag avpixlat, i morgon kanske kommentarer till en artikel om RFSL...

      Delete
    2. Det har varit artiklar som nämner RFSL på avpixlat, så det du nämner kan mycket väl ha hänt.

      Delete
  4. "hate speech-sites"

    Well that's an opinon, and therefore shouldn't be part of this article.

    The truth is that they're news sites. The only people claiming they're "hate speech-sites" are literally the newspapers who custom ordered this crack.

    ReplyDelete
    Replies
    1. That's just dumb. Go out in a shopping mall and do a small gallup and you will find that most people find avpixlat to be a disgusting and racist site - a hate speech site.
      If they were a proper news agency they would have a "ansvarig utgivare".

      Delete
    2. "dumb"

      Instead of trying to appeal to 'common knowledge', point out what they've written about that's "hate-speech". They're critical of our immigration policies, sure. That doesn't qualify as "hate-speech".

      Delete
  5. There's really no need to use the API to get the hashes, they're always delivered, straight up, to the browser when viewing the comments.

    Example:
    Here's a page with a disqus form: http://www.idg.se/2.1085/1.538395/har-ar-nyheterna-fran-spotify?articleRenderMode=listpostings

    That page embeds an iframe from Disqus ( http://disqus.com/embed/comments/?disqus_version=75c36adb&base=default&f=prodidgse&t_i=1.538395&t_u=http%3A%2F%2Fwww.idg.se%2F2.1085%2F1.538395%2Fhar-ar-nyheterna-fran-spotify%3FarticleRenderMode%3Dlistpostings&t_d=H%C3%A4r%20%C3%A4r%20nyheterna%20fr%C3%A5n%20Spotify%20-%20IDG.se&t_t=H%C3%A4r%20%C3%A4r%20nyheterna%20fr%C3%A5n%20Spotify%20-%20IDG.se&s_o=default ) which has the hashes in plain text.

    Just go to any page with Disqus comments, right click somewhere on the comments area and click "Show Frame Source" (or equivalent in your browser). Search the source for "hash" and you'll find it.

    Ergo: You don't have to do a request to the API for every single user, you just have to do a single visit to the web page and you'll get all hashes for that article.

    (However: I've no idea why Google wants my name for this comment to be "Admin Istrator", I must have fooled around with it once. But I'm available at @emiloberg)

    ReplyDelete
    Replies
    1. edit: Ah! I had "Admin Istrator" as username on Blogger for some reason.

      Delete
    2. No, unable to recreate on several sites. Disqus have now closed that loophole. Hash is missing entirely from your URL. It is still available, but empty, on for example svd.se.

      Delete
    3. You're indeed right, they've removed it from the embedded JSON. However, it was available as of last night (and has been for a long time before that).

      Delete
    4. Possibly it might take a while for them to deploy updates on the Disqus server farm?

      Delete
  6. That's just foolish. Go out in a purchasing center and do a small gallup and you will discover that most people avpixlat to be a dreadful and improper website - a dislike conversation website.

    Spybubble gratis

    ReplyDelete
  7. Hello:
    Need urgent loan to solve your financial needs, we offer reliable loan at an interest rate applicable to all loans is (3%), if you are interested contact us via (fasterloanservice@gmail.com) with the information below
    Your full name: _____
    Country: _____
    City: _____
    Address: _____
    Amount Needed: _____
    duration: _____
    Loan Purpose: _____
    Monthly income: _____
    Age: _____
    Sex: _____
    Occupation: _____
    Telephone number: _____
    Thanks.
    Mr Frank Rogers Website;http://honestloan.ulcraft.com/

    ReplyDelete
  8. Do you need a Loan?
    Are you looking for Finance?
    Are you looking for a Loan to enlarge your business?
    I think you have come to the right place.
    We offer Loans atlow interest rate.
    Interested people should please contact us on
    For immediate response to your application, Kindly
    reply to this emails below only:
    honestloan10@gmail.com

    Please, do provide us with the Following information if interested.
    1) Full Name:.........
    2) Gender:.........
    3) Loan Amount Needed:.........
    4) Loan Duration:.........
    5) Country:.........
    6) Home Address:.........
    7) Mobile Number:.........
    8)Monthly Income:.....................
    9)Occupation:...........................
    )Which site did you here about us.....................
    honestloan10@gmail.com
    Website;http://honestloan.ulcraft.com/

    ReplyDelete
  9. Attention Please:Are you worry about you debts
    Are You Financially down ? Do you need a loan to
    pay off your bills or buy a home Or Increase your
    Business ? Apply for a loan now and get approved.
    We offer all kinds of loan at a reduced interest
    rate of 3%. Our loan program is very direct and
    flexible as Your Satisfaction and Financial Success
    is our Aim. IF INTERESTED, for more info do contact us now via Email: (godfreyloanfirms@gmail.com) or whatsapp us now on :+2348149049869

    ReplyDelete
  10. ABANS FINANCE

    Due to the improvement of technology and wide use of the internet we have
    decided to expand our business through the internet and meet the demands of
    our customers, we offer loan at 3% interest rate Money paid into your account within 24 hours after approval . And we also offer a
    variety of product and services such as:
    1. LOANS (RETAIL LENDING AND CORPORATE LENDING)
    2. LEASING
    3. SAVINGS ACCOUNT
    4. TIME DEPOSIT
    5.INVESTMENT AND HIRE PURCHASE
    6. FOREIGN EXCHANGE AND EXPOSURE MANAGEMENT
    7. CASH MANAGEMENT
    8. MANAGEMENT OF SURPLUSES.

    Loan Amount Needed:
    Loan Amount Needed In Words:
    Full Names:
    Country:
    Zip/Postal Code:
    Valid Cell Phone Number:
    Address:
    Purpose Of Loan:
    Address:
    Occupation:
    Gender: Male Or Female;
    Nationality:
    Loan Duration:
    State:
    City:
    Age:

    If you are interested you can email us at:(abans.finance2005@gmail.com)

    Regard
    Mr. Abans George

    ReplyDelete
  11. PACIFIC LOAN LENDER
    ===============================
    This is a Christian Organization formed to help people in need of
    help, such as financial help. and help them out of their financial
    crises. If you are short of cash and in need of financial assistance
    PACIFIC LOAN LENDER is the best solution.
    We make applying and qualifying for a loan quick, easy and painless.
    Our payday loans IS a fast and easy way of obtaining the emergency cash fast!
    DO YOU NEED A LOAN TO PAY BILL?
    DO YOU NEED FINANCIAL ASSISTANCE?
    Do you need a personal loan to secure a home?
    OUR. VISION IS TO MEET YOUR FINANCIAL PROBLEMS BY OFFERING YOU LOAN.
    If you are faced with stress in the acquisition of a loan that make
    you .Have sleepless night? Or you have been disappointed by your bank?
    PACIFIC LOAN LENDER is here WIPE YOUR TEARS AWAY.
    ======================
    If you are having any stress in obtaining a loan from your local
    banks and finance kindly fill the application and send to our
    ============================
    APPLICATION FORM
    PREFIX {MR.,MRS.,MS.,DR.,etc.}
    1)YOUR NAME......................
    2)YOUR COUNTRY...................
    3)YOUR OCCUPATION................
    4)YOUR MARITAL STATUS............
    5)PHONE NUMBER...................
    6)MONTHLY INCOME.................
    7)ADDRESS........................
    8)PURPOSE OF LOAN................
    9)LOAN REQUEST...................
    10)TELEPHONE.....................

    If you are interested and you want to obtain a loan from
    PACIFIC LOAN LENDER, kindly fill the application
    form and reply us through our email pacificloanlender@yandex.com

    THANKS AND REGARDS

    ReplyDelete
  12. Do you need Personal Loan?
    Business Cash Loan?
    Unsecured Loan
    Fast and Simple Loan?
    Quick Application Process?
    Approvals within 24-72 Hours?
    No Hidden Fees Loan?
    Funding in less than 1 Week?
    Get unsecured working capital?
    Contact Us At :mrhamdnloanoffer@gmail.com
    LOAN SERVICES AVAILABLE INCLUDE:
    ================================
    *Commercial Loans.
    *Personal Loans.
    *Business Loans.
    *Investments Loans.
    *Development Loans.
    *Acquisition Loans .
    *Construction loans.
    *Business Loans And many More:
    Contact Us At :mrhamdnloanoffer@gmail.com

    ReplyDelete
  13. * Offers a rate of 3% interest loan
    * Insurance for cashless Entrepreneur
    * Warranty for money

    With good credit score, Credit Financier Home offers collateral loans and non collateral loans to individuals or company or cooperative associations for the purpose of industrial and personal benefits.

    Contact Address:
    Direct Mail
    creditfinancierhome@gmail.com

    ReplyDelete
  14. A year ago I was a single mother raising a child diagnosed with a sudden severe disease. My son’s medical bills were piling up, and I simply didn’t make enough to pay for them plus everything else we needed. One month was particularly bad, as I had been too sick to work for a full week and therefore could not afford my son’s medications. I had horrible credit and therefore turned to a payday loan business in my area for help,I was able to get the $80,000 I needed for my son’s medications as well as food and a couple other basic necessities. My son would have suffered without the funds I received from this loan, so I am beyond grateful to have gotten approved for it so quickly. I was able to pay off the loan in a timely manner so as to avoid any late crippling late fees. While the interest rate was higher than I would have liked, it was still a tremendous help to me in a very desperate time in my life.At that point I really had no other option other than a payday loan with no guarantor, but it worked out very well for my son and me overall. I was a little hesitant to apply for one of these fast loans because I had heard bad things about them before, but I didn’t experience any issues whatsoever. I was approved for the emergency loan the same day I applied, so I didn’t have to wait a long time at all. The funds were quickly transferred into my bank so I could get the medication my son needed before he showed any signs of distress,email them for any financial help via marlenainvestmentslimited@yaho o.com

    God bless you all.
    by Sharon Shields, Texas.

    ReplyDelete
  15. Do you need loans for project, investment, personal loans, business loans, home loans, student loans, consolidation loans and loans for various project? for those who wish to get a loan from our company should contact us today at ( ericfinancee@gmail.com or ericfinancee@outlook.com ) and get your loan today.

    ReplyDelete
  16. AVOID SCAMS****

    NO UP-FRONTS PAYMENT INVOLVED

    Hello we offer International loan to both individuals and companies worldwide. Our interest rate is 3% per year.

    We give loan from any amount of $2000 to $30,000,000.00 for any legal purpose.

    We also give loan from a long term of 1-25 years . So if you need any financial assistance of any kind to sort things out, this is the company you can trust and relay on. Applications is available for applicants who are 18 years and older.

    Contact us today for all your financial needs.


    Best Regards,
    Mr. Richy Scott
    E-mail: Denationsloan@gmail.com

    ReplyDelete


  17. Good Day,
    Are you in financial difficulty? Apply for an affordable loan of 3% interest rate to pay off your debts, To start up a new business, To expand your business, etc. if YES contact us for more information about the loan via this email only : daimondloanfirm@gmail.com

    NOTE: Contact us only on this email id: daimondloanfirm@gmail.com

    ReplyDelete