Egor Homakov
homakov.blogspot.com · Personal blog · on HN since 2012
Egor Homakov, a young security researcher, writes about web vulnerabilities in GitHub, Facebook, PayPal, and OAuth implementations.
What HN saysHN commenters link it for his GitHub and Facebook OAuth findings, and one lists it among web security blogs, though another calls him immature.
76HN people shared it
44linked it in comments
122stories submitted
6.0Kstory points
3 years agolast shared
2012people per year2026
Most-shared posts
- 1"Egor, stop hacking Github"4 people · 446 points · first shared 2012 · 111 comments on HN
- 2Hacking Github with Webkit4 people · 301 points · first shared 2013 · 78 comments on HN
- 3How github was hacked3 people · 348 points · first shared 2012 · 71 comments on HN
- 4The No CAPTCHA problem3 people · 216 points · first shared 2014 · 96 comments on HN
- 5OAuth1, OAuth2, OAuth..? (2013)3 people · 153 points · first shared 2013 · 45 comments on HN
- 6Hacking file uploaders with race condition3 people · 25 points · first shared 2014 · discussion on HN
- 7Two severe "WontFix" vulnerabilities in Facebook Connect3 people · 4 points · first shared 2014 · discussion on HN
- 8Homepage3 people · first shared 2012
- 9Did GitHub Suspend Egor Homakov account?2 people · 329 points · first shared 2012 · 120 comments on HN
- 10How we hacked Facebook with OAuth2 and Chrome bugs2 people · 299 points · first shared 2013 · 49 comments on HN
- 11How to send DMs on Twitter without permission2 people · 186 points · first shared 2013 · 56 comments on HN
- 12New Paypal gateway UI susceptible to spoofing2 people · 124 points · first shared 2014 · 51 comments on HN
- 13Account hijacking on MtGox2 people · 121 points · first shared 2014 · 37 comments on HN
- 14Token Fixation in Paypal2 people · 87 points · first shared 2014 · 15 comments on HN
- 15Whitelist Your Routes, "match" is Evil2 people · 77 points · first shared 2012 · 45 comments on HN
What HN people wrote when they linked it
raushanrajjj · 2016-05-23
I only read the past bugs reported to google and facebook, and read in depth about OAUTH.
1. http://homakov.blogspot.in/2013/02/hacking-facebook-with-oauth2-and-ch…
2. http://www.nirgoldshlager.com/2013/02/how-i-hacked-facebook-oauth-to-g…
3. https://medium.com/@atom/a-simple-bug-on-facebook-that-is-worth-8000-b…
homakov · 2014-12-07
If by "server-side" call you mean getting a token for Express Checkout, I don't see how it's different from any existing OAuth implementation where site.com/oauth/twitter redirects to twitter.com/?oauth_token=TOKEN. That's the best practice actually.
Shameless plug - i have an article on paypal's oauth which is similar to oauth1 but hasn't fixed it's token fixation bug yet: http://homakov.blogspot.com/2014/01/token-fixation-in-paypal.html
rickchristie · 2012-03-05
Read his blog: http://homakov.blogspot.com/ - GitHub suspended his account.
apl · 2012-03-04
It's unfortunate that the guy stumbling upon this apparently noteworthy vulnerability happens to be so utterly immature. [EDIT: Unsurprisingly, the dude's 18. See http://homakov.blogspot.com/p/about-me.html for reference.]
EdOverflow · 2020-01-30
Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list):
- https://blog.orange.tw/
- https://ngailong.wordpress.com/
- https://whitton.io/
- https://sakurity.com/blog
- https://homakov.blogspot.com/
- https://buer.haus/
- https://philippeharewood.com/
- https://portswigger.net/research
- https://gerbenjavado.com/
- https://medium.com/@intideceukelaire
- https://samcurry.net/
- https://stephensclafani.com/
- https://www.josipfranjkovic.com/
- https://www.arneswinnen.net/
- https://blog.assetnote.io/
- https://medium.com/@alex.birsan
- https://cablej.io/
- https://jonbottarini.com/
- https://www.corben.io/
There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference.
Shameless plug: I write about web application security at https://edoverflow.com/.
_puk · 2018-11-05
Github hasn't always used a seperate domain for user sites [0].
They do now to directly address the GP's concerns.
http://homakov.blogspot.com/2013/03/hacking-github-with-webkit.html
rhizome31 · 2017-06-24
Given he got kind of famous for breaking GitHub using a Rails bug, I'm pretty sure he was being sarcastic.
For reference:
http://homakov.blogspot.fr/2012/03/how-to.html
https://news.ycombinator.com/item?id=3663197
lightedman · 2017-01-20
As one of the project coders notes - "The normal token system revokes on password change"
Very bad security practice. Token revocation is hard, folks. If you aren't making that token expire every session then you're doing it wrong.
In fact, this was even discussed here on HN 1600+ days ago - http://homakov.blogspot.com/2012/07/saferweb-most-common-oauth2.html
zer01 · 2016-02-25
As far as I can tell that particular vulnerability isn't a CSRF at all, it's an insecure JSONP endpoint[1]. The original author is mistaken.
[1] http://homakov.blogspot.com/2013/02/are-you-sure-you-use-jsonp-properl…
ejcx · 2015-10-27
AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1].
That's one of the reasons I like this talk so much. It really cemented these type of issue with real attacks, instead of a loosely described bunch of PoC. I remember reading somewhere on an RFC (perhaps CSP) that reporting can cause unwanted information leakage, but I didn't find it in the security considerations with a quick control+f just now.
[0] - https://lists.w3.org/Archives/Public/public-webappsec/2015Jul/0030.htm…
[1] - http://homakov.blogspot.com/2014/01/using-content-security-policy-for-…
Rafert · 2015-08-25
gfosco · 2015-07-26
It's because Facebook, Google, and some others run generous bug bounties / white-hat programs. Without committing a crime, people can make a lot for disclosing it directly and confidentially. Vulnerabilities can pay 5-15k and there have been 30-40k payouts. Occasionally, you'll see a blog post explaining the process from detection to payment, like: http://homakov.blogspot.com/2013/02/hacking-facebook-with-oauth2-and-c…
FB paid out 1.3m in 2014. http://www.zdnet.com/article/facebook-bug-bounty-program-paid-out-1-3-…
dkns · 2015-07-24
I think OP meant this one? http://homakov.blogspot.ie/2012/03/how-to.html
Discussion: https://github.com/rails/rails/issues/5228
amenghra · 2015-05-05
Logged-out csrf is an issue if you are serving as an oauth provider. There might be other use cases that I haven't thought about. I would ere on the side of precaution and implement logged-out csrf.
If you create a session for the logged-out user, you must be careful about not recycling the same session once logged in or you expose yourself to session fixation.
http://stephensclafani.com/2011/04/06/oauth-2-0-csrf-vulnerability/ and http://homakov.blogspot.com/2014/01/two-severe-wontfix-vulnerabilities… explain the issue pretty well.
mikesname · 2015-02-03
I must say, having switched from Google OpenID 2.0 to Google OAuth2.0 for authentication on our site I raised an eyebrow when I belatedly read on Homakov's 2013 blog[1] that OAuth2.0 was never intended for authentication, only authorization for certain discrete resources. At least with Stack Exchange doing it I'm in good company, but - if Egor is correct - it raises the question what's really a good choice for authentication nowadays.
[1] http://homakov.blogspot.com/2013/03/oauth1-oauth2-oauth.html
sillysaurus3 · 2015-01-26
Homakov did an interesting writeup about a security architecture for an exchange: http://homakov.blogspot.com/2015/01/bitstamp-problem-and-warm-wallets.…
You're probably looking for details beyond the security architecture, like how an exchange is implemented, but I figure I'd mention it.
FunCaptcha_Jim · 2015-01-07
Hey all, this is a blog post that aims to simplify the findings from Egor Homakov in early December (http://homakov.blogspot.in/2014/12/the-no-captcha-problem.html). We've included a video (http://youtu.be/718EOIoWKAE) of a major exploit in action and chat about the implications of Mr. Homakov's findings. Hope you enjoy reading it as much as I enjoyed writing it. Any questions, fire away!
orf · 2014-12-24
http://homakov.blogspot.co.uk/2014/12/the-no-captcha-problem.html
It's not exactly a copy-paste though.
sarciszewski · 2014-12-04
I'm reading this page:
http://homakov.blogspot.com/2013/05/the-recaptcha-problem.html
Why don't they just invalidate the current challenge when a new one is requested? :S
retroencabulato · 2014-07-07
The linked W3C mailing list[1] provides some interesting discussion, as well as a blog post from Jan outlining this attack[2].
The conclusion: security benefits of CSP outweigh cons.
[1] http://lists.w3.org/Archives/Public/public-webappsec/2014Feb/0036.html
[2] http://homakov.blogspot.de/2014/01/using-content-security-policy-for-e…
jrochkind1 · 2014-05-14
> * This is how to use CORS without Preflights: http://homakov.blogspot.com/2014/01/how-to-use-cors-without-...*
Am I misreading, or is the thing you link to a proposal for what user-agents should do, rather than a technique that works now? Ah, I see you are the author of what you linked to, so maybe I am misreading?
(Also, are there secruity concerns with first making the request, and only finding out after you made it if you were allowed to make it? Seems like for POST requests (or GET requests on badly implemented apps), the request alone can be dangerous, even if the browser refuses to share the response with the script after seeing the response headers)
latchkey · 2014-05-02
How is this any different than the signed request (redirect_uri) vulnerability? http://homakov.blogspot.com/2014/01/two-severe-wontfix-vulnerabilities…
ghiculescu · 2013-11-30
Egor talked about it more in his original post, http://homakov.blogspot.com.au/2013/05/do-not-use-rjs-like-techniques.…
He also linked to a post from six years ago[0] which had a good solution the problem at the time: pass data, not code (and process this data on the client side).
[0]: http://yehudakatz.com/2007/05/18/railsconf-talk-recap/
danso · 2013-08-17
This is a pretty vicious error but common one...it sounds like the analogue to Rails' mass-assignment default protections, which were exploited on Github by tampering with the params via inspector.
Coincidentally, that bug was also exposed by a non-native English speaker who was dismissed for his inability to fluently express himself.
http://homakov.blogspot.com/2012/03/how-to.html
matthavener · 2013-06-04
If someone can host arbitrary html and js on the *.github.com domain, they can set cookies for github.com. See http://homakov.blogspot.com/2013/03/hacking-github-with-webkit.html
molecule · 2013-04-05
Egor Homakov's write up of the session fixation and CSRF vulnerabilities that this addresses:
http://homakov.blogspot.com/2013/03/hacking-github-with-webkit.html
qompiler · 2013-03-07
OAuth has been called flawed by security experts because it's filled with trap holes for developers to fall into[1] and former developers who left the project[2].
1. http://homakov.blogspot.jp/2013/03/oauth1-oauth2-oauth.html
2. http://en.wikipedia.org/wiki/OAuth#Controversy
glitchdout · 2013-03-04
And here are all of Homakov's achievements this year: http://homakov.blogspot.pt/2013/03/contributions-2012.html
Pretty impressive!
judofyr · 2013-02-23
Facebook's OAuth2 implementation is so broken. Homakov found a X-XSS-Protection-related issue: http://homakov.blogspot.no/2013/02/hacking-facebook-with-oauth2-and-ch…
After reading Homakov's and Nir's discussions I started looking for some bugs myself. And guess what? ~10 hours later I found another access_token-stealing exploit that has the same implications as Nir's exploit (although mine doesn't work in all browsers). Reported it 2 days ago.
Wouldn't surprise me if there's more bugs/exploits to be discovered :(