BeTwittered is a simple and comfortable gadget that you can add to your site, such as your iGoogle homepage.

Since BeTwittered is just a bridge between you and Twitter, it has to first log you into your account. Here is where things go horribly, horribly wrong.

1. BeTwittered does not use SSL to secure requests to its servers

All authentication information is transmitted to BeTwittered servers in plain text and is easily sniffable by an attacker, both on your own network and outside of it. You can read more about SSL encryption here.

Since BeTwittered passes your Twitter username and password unencrypted as GET parameters, it may as well be serving them to potential attackers on a silver platter (note that passing this data in a POST request would change nothing, security-wise).

Here is an example request:

http://betwittered.com/api/?_=1265242511260&req=verify_credentials&username=foo&password=bar

Ugh…

2. BeTwittered stores your username and password in unencrypted cookies

Because BeTwittered tries to keep you logged into Twitter, it caches the username and password, unencrypted, inside browser cookies.

This means that an attacker needs to simply look at your cookies to steal this information. This can be done using these methods, among others:

• using an XSS vulnerability
• sniffing the network traffic
• walking up to your computer

3. Because BeTwittered passes your authentication information to its servers, it's already insecure

If someone gets access to BeTwittered servers, it's safe to assume at that time that all accounts are potentially compromised.

Smaller sites generally cannot dedicate appropriate resources to securing their servers, which can make breaching them easier for hackers. Even Twitter itself was hacked numerous times.

The Alternative Solution

oAuth

If the endpoint application supports oAuth (Twitter has for months), do us all a favor and use it. Please.

oAuth allows delegating authentication to Twitter itself and only giving the application easily revokable limited access.

If BeTwittered were using oAuth, the user would be redirected to Twitter, where he or she would login. Then, the user would be sent back to BeTwittered, but now bearing special tokens. Any requests to Twitter would then be accompanied by these tokens, which would be validated by Twitter every time they're used – all of this without ever passing your password around.

You can find a nice overview of the oAuth architecture here.

Otherwise

If the endpoint application doesn't support oAuth, then

• use SSL encryption (https)
• store the authentication information on the server side instead of the client side in a cookie. Instead, use the cookie to store some sort of an internal ID pointing to this server-side data. Alternatively, encrypt the username and password via a secure salted two-way hash and only then store the encrypted version in a cookie
• make sure to stay on top of securing your servers (and give your sysadmin a raise). It's a time-consuming commitment, please take it seriously

Conclusion

What other secure authentication technique or tips do you know about? Feel free to share in the comments.

Oh, and this goes without saying – stop using BeTwittered, at least until they implement a more secure login option. I've alerted the creators about the issue and also started these threads on HN and Reddit.

• sysbench – Linux Test Bench
• Do NOT Use This Perl Module: Passwd::Unix
• How To Fight Clickjacking (Using The Recent Twitter Hijacking As An Example)
• Debugging Weird sshd Connection Problems + What Happens When You Stop sshd
• How To Fix Palm Pre's "Error Sending Mail" Problem

I was working with a site that was using frames. Suddenly, one of the frames (which was hosted on a domain that differed from the one it was embedded in) displayed the following message (in Firefox 3.5.4):

This content cannot be displayed in a frame
 
To protect your security, the publisher of this content does
not allow it to be displayed in a frame.
 
Click here to open this content in a new window

Notice how this is a native Firefox window and not a web page rendering. Quite stumped, I started looking at the frame response and finally found that it included this little header:

X-FRAME-OPTIONS: DENY

Turns out that modern browsers like Firefox 3.5 (turns out it's the NoScript addon that does this and not Firefox itself) and IE8 treat this header as a precautionary measure and display a generic "warning" to the user instead of the page content in certain conditions described below. This effort, led, surprisingly, by Microsoft, was really to protect users from clickjacking (I wrote about clickjacking here earlier) but can be viewed as an alternative to framebusting.

Microsoft introduced the new X-FRAME-OPTIONS header with the following possible values:

• DENY – prevents the page from being rendered if it is contained in a frame
• SAMEORIGIN – same as above, unless the page belongs to the same domain as the top-level frameset holder.

Firefox adopted this technique a few months later (again, I was wrong here – it was NoScript that did it), and I expect other browsers to follow.

So what does it mean to you, the developer?

• setting such a header will essentially render frame busting code unnecessary in modern browsers
• but it has a downside of displaying a relatively ugly warning to the user
• no automatic redirect is done as your page (including any framebusting code) is not loaded
• thus requiring an extra click
• and popping up a new tab or window
• it will work even if the user has Javascript disabled, which is more secure

Some useful discussion on the issue can also be found in this post on Hackademix.net.

So is it good practice to use this new X-FRAME-OPTIONS header instead of the traditional framebusting code? I definitely think so, especially if Firefox and other browsers start supporting it. What do you say?

• How To Fight Clickjacking (Using The Recent Twitter Hijacking As An Example)
• Meet Firefox For Mobile [Video + Feature Highlights + More Info]
• Watch – A Useful Linux Command You May Have Never Heard Of
• How To Make Your Site Lightning Fast* By Compressing (deflate/gzip) Your HTML, Javascript, CSS, XML, etc In Apache
• Rendr – a Live Awesome CSS/HTML Rendering Tool

Password Protected Garage Door Remotes

As a paranoid person and a recent homeowner, I started to wonder how safe I actually am in my house. Consider this likely scenario that nobody seems to be concerned with:

I park my car outside for one night and don’t take out my portable garage door remote, the one with a single open/close button. Or, even worse, the remote code is programmed into one of those garage opener buttons built into the car. A car burglar comes along, breaks the window, and trashes my car. Wow, an added bonus – a free entrance into the house!

Needless to say, this is bad already. How many of you lock the door between the house and the garage? What if you forget to do that as well? Is there a spare house key laying around in the garage? You may say “but I’ll hear the garage door open” but does it actually make you feel better? You will be present with an intruder in your house, which will scare the living shit out of you non-governator types.

So here’s my question to you, Internet, is there a garage door remote I can buy that has a programmable keypad, so that a password is needed for the button to work? In fact, it would be almost the same as the one that mounts next to the garage door. And can it not cost $100?

Twitter Security

This part is not about computer security, as you may have thought at first, although I did recently discuss it in the Clickjacking article. I also know that I’m not the first one to bring this issue up but I think it’s worth discussing some more. Consider this scenario:

You’re a cheerful, outgoing snowboarding enthusiast with 3000 twitter (plurk, facebook, or another social network but twitter is the most relevant example) followers. Or maybe you have 3 followers. There’s a 99.9% chance that your profile and updates are public (if you have 3000 followers with a private profile, you must be some sort of a chump. And yes, I did just make the stats up, want fight about it?).

So, on Friday night, you send the following tweet: “Gone snowboarding for the whole weekend. But not before getting piss trashed Friday night at the casino. Wooooo”.

Since anybody can watch your tweets absolutely anonymously and it’s extremely easy to dig up an address knowing very little about a person, what you just said was “If you are a burglar looking for the next opportunity, just drop everything and come on by Friday night. I will be far-far away but my house (located at 123 Main St) will be available for your robbing pleasures. You only have 2 days before anyone is home, so feel free to crash on the couch and eat my food. Don’t forget to feed the cat. Kthx.”

Is this a likely scenario? Not really, unless twitter raises the tweet length to more than 140 characters, but otherwise you see where I’m going with this. Don’t be stupid – avoid advertising exact details of your whereabouts, vacation plans, etc. There are plenty of uses for Twitter without giving up most of your privacy. Ask yourself: would you post a note with your whereabouts on your door every time you leave the house for a while?

How Do Trains And Buses Know Where They Are?

If you live in a relatively large city, you have seen relatively accurate bus and train arrival predictions and, in some cases, almost exact locations of each vehicle. For example, here in San Francisco we have MUNI stations with live maps of trains’ whereabouts and bus stops with bus predictions on small electronic displays.

What is the technology behind it? It cannot be just GPS, because trains go underground where there is no reception. If it’s a combination of externally mounted sensors, are they also placed outside, once the train gets out into the street? Or is it some sort of a 2-way GPS (a conventional GPS device is just a receiver) underground that switches to sensors above ground? I don’t know but I want to.

Train/Bus Drivers And Bathrooms

While I’m on the public transportation subject, here’s what I want to know: if you are a train/bus/trolleybus driver, what do you do if you NEED to go somewhere when you are half way down your route? All of us had such moments at least once, and sometimes you just HAVE TO drop the bomb, sink some submarines, drop the kids off at the pool, release the chocolate hostage, plant some potatoes, give birth to a VB programmer, down the proctoscope, bake some brownies, you know what I mean (if you don’t, you’re a senile muppet, what are you doing on the Internet?).

They can’t just leave the train in the middle of the street, can they? Have you ever seen one run out in the middle of the street? I’m really curious here.

All Of Dilbert

Is there a Dilbert collection somewhere that has every Dilbert comic in an easily browseable manner, ideally with ratings I can sort by? 100 Dilberts per page would be ideal. Ah, looks like the new Dilbert.com finally made it a reality: all Dilbert comics sorted by votes, 49 per page.

Where Can I Buy A Circus Tent?

Who sells them? The ones where elephants and clowns could fit. It could also double as a portable office.

Who Gets To Eat The Most Delicious Burger In Burger Commercials?

And where do I sign up? I’m serious.

● ● ●

Yeah, so that’s pretty much what’s on my mind right now. What’s on yours?

• Enable A Twitter Retweet (RT) Button That Lets You Add Comments Before Retweeting
• [Twitter] The Most Useless Tweet To Date Discovered
• Twitter.com Autocomplete, Auto URL Expansion, Auto URL Shortener, RT Button, Nested Replies, Inline Media Embed, Search Tabs, And More
• The Real Reasons To Use Twitter (Get Over Your Prejudice Already)
• Amazon Posts The Deal Of The Century: Ultimate Ears TripleFi 10 & 10vi Earphones – $99, Down From $399 – Amazing Value, Perfect For Mobile Phones

Clickjacking is a malicious technique of tricking web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages. A vulnerability across a variety of browsers and platforms, a clickjacking takes the form of embedded code or script that can execute without the user's knowledge, such as clicking on a button that appears to perform another function (credit: Wikipedia).

Clickjacking is hard to combat. From a technical standpoint, the attack is executed using a combination of CSS and iFrames, which are both harmless web technologies, and relies mostly on tricking users by means of social engineering. Additionally, the only server side technique against clickjacking known to me is “frame breaking”, which would cause a legitemate site to break out of any iFrames it may be embedded in. This is not always the desired behavior and is generally frowned upon.

Generic Example

In laymen’s terms, clickjacking means that it is quite possible for websites to trick you into, for example, clicking a button to show a cute kitty while in reality prompting a deletion of all your hotmail email. A malicious site uses an iFrame (which essentially allows embedding sites within other sites) with hotmail loaded inside and hidden using CSS (which is a web language for styling HTML elements). A button named “Show Me The Next Awwww Kitty” is then placed by the malicious site and positioned below the iFrame layer (manipulated by CSS, yet again). However, because the iFrame is hidden, it looks like the “Aww” button is all you’re clicking. Wrong!

Latest Example: Twitter

This morning a new, though harmless, epidemic hit twitter. Hundreds and thousands of messages saying “Don’t Click: http://tinyurl.com/amgzs6” started showing up. Clicking the link shows a simple page with 1 button:

Clicking (which I of course did) uses clickjacking to repost the message to your own twitter account. Take a look yourself: http://search.twitter.com/search?q=don%27t+click.

All of these are a result of an experiment by some French guys to mess around with twitter and show the effects of clickjacking. Thank you for that, French guys. Creating awareness via the most social platform on the web is the best thing they could do for us.

Fight Clickjacking

James Padolsey recently wrote an excellent blog post about clickjacking and mentioned Twitter specifically. Because clickjacking relies mostly on social hacking (i.e. tricking people into clicking malicious links and buttons), Twitter is nothing but a perfect platform. James gives some nice background info and code examples. He correctly highlights, as I did earlier, that clickjacking is not a software bug – it’s a malicious technique exploiting harmless technologies.

So how does one fight clickjacking?

At this point the most reliable way is to use Firefox and the NoScript extension. NoScript provides a simple, yet amazingly effective feature, called ClearClick. From their site:

“…it's enabled by default, protecting NoScript users from Clickjacking everywhere: it even remains active if you switch NoScript in the less safe Allow scripts globally mode. How does it work? Clickjacking hides or displaces or partially covers something you wouldn't want to click, if you could see it in its original context. ClearClick does the opposite: whenever you click a plugin object or a framed page, it takes a screenshot of it alone and opaque (i.e. an image of it with no transparencies and no overlaying objects), then compares it with a screenshot of the parent page as you can see it. If the two images differ, a clickjacking attack is probably happening and NoScript raises a "ClearClick warning", showing you the contextualized and "clear" object you were about to click, so you can evaluate by yourself if that was really something you wanted to do.”

Did ClearClick work in the earlier twitter attack? Sure did! After I clicked the “Don’t click” button Noscript promptly popped up a warning showing the hidden iFrame (since the original malicious page has been removed, I found another similar page from the same author for screenshot purposes).

So, even if you don’t want to enable NoScript globally, install it anyway, just for ClearClick.

That about covers what I had to say about clickjacking. Stay safe, folks!

• Modern-Day Frame Busting With X-FRAME-OPTIONS And "This content cannot be displayed in a frame" Warnings
• Enable A Twitter Retweet (RT) Button That Lets You Add Comments Before Retweeting
• How *Not* To Implement A Web Application That Handles External Authentication, Using BeTwittered.com As An Example
• StackOverflow.com, SuperUser.com, ServerFault.com Fan? Here's A Greasemonkey Script To Keep Track Of All Your Accounts
• Hidden Features Of Perl, PHP, Javascript, C, C++, C#, Java, Ruby, Python, And Others [Collection Of Incredibly Useful Lists]

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0.

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0.

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0.

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0.

Destroy DRM.

• MySQL Conference Liveblogging: EXPLAIN Demystified (Tuesday 2:00PM)
• MySQL – Sun – Flickr – Fotolog – Wikipedia – Facebook – YouTube Comparison – MySQL Conference Day 2 Keynote
• Youtube Custom RSS Search Results
• MySQL Conference Liveblogging: MySQL Performance Under A Microscope: The Tobias And Jay Show (Wednesday 2:00PM)
• Central Room of Potatoes

An unbelievable security flaw in locks, this is a very good lockpicking technique, works on at least 90% of all pin locks, very interesting, the man in the video is Barry Wels, a lock and security extrodinaire.

• Ali-G Interviews Posh Spice and David Beckham – Funny As Hell
• Modern-Day Frame Busting With X-FRAME-OPTIONS And "This content cannot be displayed in a frame" Warnings
• Unbelievable! Working and Active Exploit on citibank.com and Many Other Sites
• MySQL – Sun – Flickr – Fotolog – Wikipedia – Facebook – YouTube Comparison – MySQL Conference Day 2 Keynote
• Google Phone (Android) Demo Of Streetview With Compass

Here's the link: click here

Unbelievable! This exploit is claimed to exist on 250+ sites. Here's the quote from the guy who found it:

"Look by yourself – this is how citibank.com cares about phishing and password theft. I reported it 20 hours ago. Nothing happened. Maybe it's time to make it public? It is an active link to working exploit, ready to send YOUR data from citibank.com domain to attacker's server – so dont give your real login and pass please."

Reported on digg.com.

• Monitor All Your Domains From One Location
• How *Not* To Implement A Web Application That Handles External Authentication, Using BeTwittered.com As An Example
• Do NOT Use This Perl Module: Passwd::Unix
• Delicious.com [Quietly] Rolls Out Domain And Url Searching/Filtering. Finally!
• A Happy Weatherman?