Detectify Labs
labs.detectify.com · Company blog · on HN since 2014
Detectify Labs is the security research blog of Detectify, covering web vulnerabilities, OAuth flaws, subdomain takeovers, and cloud misconfigurations.
What HN saysCommenters cite it as the origin of subdomain takeover research and credit its OAuth account hijacking post as the source of their OAuth knowledge.
58HN people shared it
24linked it in comments
49stories submitted
2.6Kstory points
2 years agolast shared
2014people per year2026
Most-shared posts
- 1LastPass autofill exploit14 people · 1.0K points · first shared 2016 · 420 comments on HN
- 2Account hijacking using “dirty dancing” in sign-in OAuth-flows4 people · 4 points · first shared 2022 · discussion on HN
- 3Popular Google Chrome extensions are constantly tracking you by default3 people · 188 points · first shared 2015 · 74 comments on HN
- 4The story of EV-SSL, AWS and trailing dot domains3 people · 7 points · first shared 2016 · 1 comments on HN
- 5A deep dive into AWS S3 access controls – taking full control over your assets3 people · 4 points · first shared 2017 · discussion on HN
- 6I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018)2 people · 249 points · first shared 2018 · 77 comments on HN
- 7Slack Bot Token Leakage Exposing Business Critical Information2 people · 33 points · first shared 2016 · 1 comments on HN
- 8How Patreon (probably) got hacked – Publicly exposed Werkzeug Debugger2 people · 32 points · first shared 2015 · 5 comments on HN
- 9Hacking CloudKit: How I accidentally deleted your Apple shortcuts2 people · 19 points · first shared 2021 · 2 comments on HN
- 10How I disabled your Chrome security extensions2 people · 10 points · first shared 2015 · discussion on HN
- 11Middleware, middleware everywhere – and lots of misconfigurations to fix2 people · 2 points · first shared 2021 · discussion on HN
- 12CSP flaws: cookie fixation2 people · 2 points · first shared 2017 · discussion on HN
- 13Almost impossible Slack XSS2 people · 2 points · first shared 2016 · discussion on HN
- 14Hacking Slack using postMessage and WebSocket-reconnect to steal your token1 people · 343 points · first shared 2017 · 23 comments on HN
- 15How to Hack APIs in 20211 people · 334 points · first shared 2021 · 89 comments on HN
What HN people wrote when they linked it
sharestuff · 2021-02-26
There was a follow-up to this released last week by Frans Rosen on Detectify Labs that looked into middleware in general and still applicable to nginx: https://labs.detectify.com/2021/02/18/middleware-middleware-everywhere…
ktta · 2017-03-22
I don't think I'd call them a 'sham'. They're not advertising something they don't do. I think they do everything that they say they do[1]. If this was a case where someone was able to get plaintext passwords from lastpass's server, you'd be right.
The first thing I think people should realize is that there are vulnerabilities in every software, and addressing that fact goes a long way. I doubt that they weren't following standards, and they do have a good track record of security although they get flak for being a extension based password manager (which is a very bad idea, something I've come to realize not long ago. I think it was at the time of lastpass's last vulnerability[2])
If you don't mind, I'm interested in know what you'd consider products with 'strong security'?
[1]:https://www.lastpass.com/how-it-works
[2]:https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
hannob · 2023-01-09
As you plug this paper, I should point out that it's really bad behavior to not cite prior work. The original idea of subdomain takeover was by Frans Rosén:
https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using…
When your paper came out some media articles made it sound like you invented the method, as you didn't bother to cite the original finder.
I know, academics don't like to cite "gray literature". But that's really not ok.
csande17 · 2022-12-01
Critical security vulnerability in an iOS-exclusive app? I bet they're using CloudKit and forgot to implement server-side access control. (Even Apple screws that up half the time: https://labs.detectify.com/2021/09/13/hacking-cloudkit-how-i-accidenta…
thr0wnawaytod4y · 2022-11-23
all my real oauth knowledge came from this https://labs.detectify.com/2022/07/06/account-hijacking-using-dirty-da…
mada360 · 2022-01-05
I think not having auto-fill enabled by default is a conscious decision as there was a big fuss how auto-fill can be abused because the input can be captured without submitting. https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
There is the option to enable auto-fill on page load though https://bitwarden.com/help/article/auto-fill-browser/
rgovostes · 2021-12-06
PHP has some Easter eggs which reveal contributor credits in response to a request with certain GET parameters. This can be used to fingerprint the server version: https://labs.detectify.com/2012/10/29/do-you-dare-to-show-your-php-eas…
staticassertion · 2020-04-14
It's definitely a fine sanity check but I'd have to really think about whether it's a barrier.
Immediate things I worry about are around URL parsing.
Is evil.com<insert something here>steampowered.com going to pass as "steampowered.com" when it isn't? Will it handle punycode? All sorts of shit can go wrong when parsing a URL, and it's a real world problem when people implement the mitigation you're describing[0].
https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
This is just for starters. I think if I were being paid to think about it I'd probably be able to come up with some more. Can I mess with DNS? Can I inject some other malicious payload into the page, to take advantage of other vulns? etc etc etc
I would be extremely wary of this technique as a real boundary rather than just an assertion in code.
christopherbalz · 2020-03-04
An oldie but a goodie: https://labs.detectify.com/2014/12/08/hijacking-of-abandoned-subdomain…
zulln · 2018-07-03
Back in 2015 when Detectify (me being co-author) looked into this issue [1] many plugins do not actually have this code in the extensions, but rather a feature to download remote code and add it to the extension so to say. As long as that practice is allowed, source review would not help.
[1] https://labs.detectify.com/2015/11/19/chrome-extensions-aka-total-abse…
angry_octet · 2018-06-24
While this is true, it is complicated by TLS terminating cloud services and the complexity nightmare that is TLS. For example, sub-domain takeover. Basically, TLS rules don't behave exactly as CORS:
https://labs.detectify.com/2016/10/05/the-story-of-ev-ssl-aws-and-trai…
You could also use the dangling domain to get a Let's Encrypt certificate.
It is quite common for sites to allow cross-origin loading from their own subdomains, with CORS and CSP headers.
arachnids · 2018-02-28
Using 1Password to store your 2fA seed makes it single factor because your password and second factor are stored in the same place. This is not a good idea.
Yubikeys in U2F mode are better than any OTP because they protect you against phishing attacks. 1Password auto-filling arguably has this property too, but you should disable that sort of password manager behavior:
https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
notspanishflu · 2018-02-11
Related tweet https://twitter.com/fransrosen/status/962709013329670145
"Same attack as described here: https://labs.detectify.com/2017/07/13/a-deep-dive-into-aws-s3-access-c… … it's scripts hosted in a S3-bucket without proper access controls"
Edit. Also see https://scotthelme.co.uk/protect-site-from-cyrptojacking-csp-sri/
craftyguy · 2017-12-28
Here, since you can't be bothered to do your own research before jumping to conclusions:
https://www.theverge.com/2017/3/22/15023062/lastpass-security-flaw-pas…
https://www.pcworld.com/article/2936621/the-lastpass-security-breach-w…
https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
mrguyorama · 2017-09-12
That's not always how it was though. Lastpass used to hand out all your data to pretty much any website that asked nicely[0].
I imagine password managers on mobile devices will have their own teething problems. I will just be patient and wait for them to mature
0. https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
Cpoll · 2017-06-01
> they test to see if your database is decryptable with the password you entered (after it is hashed).
At which point they have full access to your database, don't they?
> And you can already read the Lastpass browser extension's source code
Of course, it's a bit more difficult, I'm betting it's minified.
High profile open source encourages people to read the source code, if nothing else. It's possible someone would've noticed that nasty cross-domain autofill bug from a while back (https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-… It's also possible that the community would hold the codebase to a higher quality standard, and a lot of issues would go away (only a rumor, but I've heard that parts of the LastPass codebase are a mess).
unholiness · 2017-01-11
> Password managers really shine at times like these
I agree on some levels, but password managers can and have had vulnerabilities[0] that can allow the gmail password to be populated despite the wrong domain. Given that the autofill adds legitimacy and reduces friction, it could make this particular scenario go from bad to worse.
[0] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
__jal · 2016-11-22
> So if you cracked my LastPass vault - good luck with that, 2FA considered
Well, the traditional[1] way to break[2] LastPass is to ignore individual accounts and go after poor coding technique[3]. 2FA won't help you there.
[1] https://www.wired.com/2015/06/hack-brief-password-manager-lastpass-got…
[2] https://techcrunch.com/2011/05/05/password-manager-last-pass-possibly-…
[3] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
hughes · 2016-10-24
Don't forget that the LastPass chrome extension has been tricked in the past to extract passwords from arbitrary domains. It's still important to use your brain when clicking links and invoking LastPass's autofill functions.
https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
hrez · 2016-08-31
Here are recent LastPass vulnerabilities:
http://www.theregister.co.uk/2016/07/27/zero_day_hole_can_pwn_millions…
https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
cottsak · 2016-07-28
This is not the same as https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-… is it?
punjabisingh · 2016-07-27
It's confusing that the LastPass site is claiming only Firefox is impacted. [1] Whereas the security researcher's site (detectify.com) shows the vulnerability running in Chrome. [2]
Furthermore, the current live version on Firefox addons repository is 3.x [3], which the LastPass team claims is not vulnerable. [1]
[1] https://blog.lastpass.com/2016/07/lastpass-security-updates.html/
[2] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-…
[3] https://addons.mozilla.org/en-US/firefox/addon/lastpass-password-manag…
mwarkentin · 2015-10-02
Apparently they were compromised via a publicly exposed Werkzeug debugger: http://labs.detectify.com/post/130332638391/how-patreon-got-hacked-pub…
Digital-Citizen · 2018-06-22
"Probably refers to"? That you don't know what "secure" refers to is itself a problem. But more problematic is anyone's defense of Google Chrome's architecture while overlooking that that architecture is implemented with secret software which you aren't allowed to vet, alter, or share with others (parts of software freedom).
This proprietary software apparently allowed for sending Google every URL a Chrome user types in (http://www.favbrowser.com/google-chrome-spyware-confirmed/) and making it easy for extensions to spy on Chrome users (https://labs.detectify.com/2015/07/28/how-i-disabled-your-chrome-secur… which many Chrome extensions apparently do, or activating a Chrome user's microphone and sending the captured data to Google (https://www.privateinternetaccess.com/blog/2015/06/google-chrome-liste… Hardly behavior users are likely to call "secure" because such behavior does not look out for the security of its users, but instead securing access to Chrome user's data.