Today's Bad Idea: MyMoney

Warning: This post makes heavy use of a cutting-edge rhetorical device known as "sarcasm." If your brain has a defective superior frontal gyrus, please consult your doctor before continuing.

I'm a heavy Facebook user, and most of my friends are too. I love it! Facebook is like an online portal to my social life. It also has a convenient platform for including third-party applications, so I can not only communcate with my friends: I can also play online poker, have (simulated) gang wars, and send fun quizzes to them. Awesome!

The only thing I was really missing was the ability to manage my finances from my facebook page. It drives me insane to have to fire up a separate web browser, navigate to my bank's website, type in a username and a password and punch in those frustrating digits from my hardware token. That's just too much work. If I had my way, I'd have a running counter of my net worth on my Facebook wall, like a villain from a James Bond movie. Bummer!

Imagine how excited I was to receive an email from Etienne Janot, letting me know that the future is here: Fiserv has a product called MyMoney. MyMoney is an application that "enables Facebook users to search for and join a financial institution and manage their funds via the familiar Facebook interface." Sweet!

The video on Fiserv's website really sells it to me: it helps bring the boring world of banking to us fast-paced Gen Y users. Not only that, but (quoting from their website, because I really couldn't make this up) "MyMoney also leverages Facebook's viral marketing opportunities. When Facebook users add MyMoney to their profile, their friends are notified and given the opportunity to add it too, enabling financial institutions to extend their reach, particularly within the Gen Y market." I've always wanted to know who my friends bank with, and now, thanks to MyMoney, I can! Woot!

I know you're thinking this is a bad idea, and are concerned about MyMoney's security. Don't worry, I checked it out. They have "multiple layers of security protecting...data and accounts." The application iframes you into their site (hosted on https://mm.galaxyplus.com). If you forget the URL, they left zone transfers enabled for you, so you can just select from a list of galaxyplus.com subdomains. The iframe's URL has a parameter called "fb_sig_user." If you manipulate this parameter, you get to see the contents of all your friends' accounts (presumably so you can borrow money without all that awkward asking). The only thing I don't like about this application is that they left error reporting on. I don't like seeing those ugly ASP stack traces every time I use an HTML tag as a form parameter. Lol!

All in all, I'd say this whole MyMoney thing is a pretty damn good idea. I'm glad somebody did it.

PHP.net XSS: Mass Carnage with Mirrors

I found a minor hole in php.net the other day. It's a small reflected XSS hole that uses URI parameters. At first, I thought it wasn't a huge deal, and wrote up a vuln report.

Then it occurred to me to look deeper, and I found that there are hundreds of mirrors of the php.net site, spread across the internet in what turned out to be some awfully interesting locations. Many of the domains it is mirrored on are web hosting companies, and most of those have some type of customer portal on the same domain. In addition to these, there are some .gov and .edu sites of interest, and the really interesting one- Facebook.



While Facebook's session cookies are set as HttpOnly and not accessible to javascript, this is still a serious issue. First off, not all browsers support HttpOnly cookies. Second, HttpOnly implementations aren't perfect. Finally, even the non-HttpOnly cookies contain valuable data which can be leaked through the subdomain. I wrote up a proof of concept that will allow me to de-anonymize users by reading their facebook UID off of php.mirror.facebook.com.

In fact, I sent a vulnerability report to Facebook as well, and sent them the wrong link- normally I'd just pop an alert box as a proof-of-concept, but I accidentally sent the link with the weaponized cookie-stealer in it. Much to my surprise, I checked my logs this morning and found that one of Facebook's product managers had clicked the link. I suppose there' a lesson in there about not trusting the link that some random hacker sends you, even if they seem helpful.



The php.net people responded quickly and fixed this vulnerability, and the fix is slowly propagating to the mirrors, but I have no doubt that more exist. This got me thinking about the possibility of writing a cross-domain XSS worm. It turns out, it's completely possible, though in this case the scope is a bit limited.

Lessons learned: Be careful with where you get your content, and what you put on your subdomains- mirror.victim.com can nearly as useful to an attacker as www.victim.com.