Sunday, August 22, 2010

Foursquare considered harmful - DON'T USE [Updated w/ 4sq's reply]

Update [2010-08-31]: foursquare has released their v1.9.2 update on App Store today which should fix the problem.

Update: I posted this on Aug 21st morning and foursquare replied to my blog post with a statement on their HTTPS authentication system rollout that night, so they're working on fixing the issue right now. That's actually a very awesomely fast response. Looking forward to their next update.

Yet Another Update: It has come to my attention from reader fdqps that Gowalla for iPhone is having the same problem. I've run the same test on Gowalla, and unfortunately, I can confirm they're having the same problem as well. So, stop also using Gowalla until they've rolled out an update for this problem.

One More Update: Gowalla has responded this morning that they're rolling out a client update in the near future that'll fix the security problem. Again, very fast response.

Original blog post below:

If you care to intercept the messages your Foursquare app sends out from your iPhone.. you'll see something very unpleasant.

The above screenshot was taken from Wireshark listening in on a gateway Wifi NIC to my iPhone. Take a good look at the "Authorization: Basic" line in the above screenshot - Foursquare sends my account's username and password in plaintext over HTTP, without any encryption. They send it every time you open that Foursquare app. If anybody has access to any routers between you and foursquare, or foursquare's DNS happens to be hijacked by anybody anywhere up your DNS chain.. or someone is setting up a public wifi intercepting foursquare HTTP requests, and you joined it... you're screwed.

Yes, I said they send it every time.

I wasn't aware of the problem until I saw the Gaming foursquare with 9 lines of Perl article from Slashdot this morning. Plenty of people are trying to shorten that 9 lines of Perl on Slashdot.. but the big problem I noticed from the source code was... Why the hell can I send my login/password in plaintext and login to foursquare, at all?!!

So, in conclusion, don't use foursquare until they fixed their security hole. If it's on your mobile phone, remove it right now. Facebook Places is at least decent enough to do the login part via HTTPS.

Update: I see quite some people on Hacker News are having a hard time believing it. You can reproduce this screen with your own Wireshark and any Wifi access point. I used MacBook Pro's Internet Sharing to do it. Here's how you can reproduce it:

  1. Plug your MBP to wired ethernet - you have one of these in your home, right?
  2. Open an ad-hoc network in your MBP, and share Internet access via that ad-hoc network.
  3. Connect your iPhone to your MBP's ad-hoc network, now it should be able to access the Internet via your MBP.
  4. Install and fire up Wireshark in your MBP - make sure to read the instructions or otherwise it can't capture packets.
  5. Get Wireshark to capture packets on the ad-hoc Wifi interface.
  6. Filter out the HTTP packets going to *.foursquare.com by adding the filter 'http.host contains "foursquare"'
  7. Fire up Foursquare on your iPhone, login if you haven't already
  8. Boom, you've just sent your password in plain text, over the Internet.
Update 2: A commenter, kidsat, on Hacker News found Foursquare for Android is doing the same thing. So if it's on your Android phone, remove it too - wait for them to fix the security bug before you go back to use it

75 comments:

Anonymous said...

yah defcon's wall of sheep made that real obvious lol.

naveen said...

we're in the final stages of testing and integrating a new auth system, which you should see next week in our apps.

more here: http://blog.foursquare.com/post/990202740/changes-to-our-authentication-system

Joost Schuur said...

You could just change your password to something you don't use anywhere else. No harm in someone getting access to your Foursquare account.

Anonymous said...

Of course you should use different passwords on every single site/app.

http://www.lastpass.com helps a lot with doing that.

Kou Man Tong said...

@naveen Nice seeing foursquare coming back with a reply so fast. I can see you guys care a lot about your product and users. I've updated my blog post regarding your upcoming update.

fdqps said...

It seems that also Gowalla is sending in clear text.

Kou Man Tong said...

@fdqps Unfortunately... yes. I've just checked Gowalla for iPhone with the same procedure, and they're doing exactly the same thing as foursquare. So Gowalla is also not safe.

Faisal Asif said...

Great! Just great! Was this a mistake or they never thought of it? Foursquare & Gowalla need some Security geeks in their team.

Good that they're working on it instantly.

Renaud said...

Why would anyone want to hack a Foursquare/Gowalla account? There's no credit card file.

Scott Raymond (Gowalla) said...

We added OAuth2 support to the Gowalla API in the last couple of weeks, and are working on rolling out client updates now to take advantage of it.

Kou Man Tong said...

@Renaud Problem is most people reuse passwords and even user names. And then it's the way check in apps are usually used - you go to crowded places and use it. What this means is you can quite easily set up a public wifi in any crowded place and get back a bunch of passwords that logs into other people's Gmail, Facebook, bank account, etc.

Kou Man Tong said...

@Scott I've updated my blog regarding the rollout. Good to see another awesomely fast response from you guys.

Angel B said...

Just one question: Does this problem appear only in iPhone and Android apps or is also present in the mobile Foursquare page?

Kou Man Tong said...

@Angel their mobile page is also at risk. You can perform the same steps with their mobile page and you'll also see your password coming out of your cell phone unencrypted.

Anonymous said...

This was discussed back in February: intrepidusgroup.com/insight/2010/02/im-in-ur-4sq-snarfin-ur-password-part-i/

Too bad Foursquare didn't care back then.

Kou Man Tong said...

@Anonymous I'm sure there're people who're aware of this problem well before I posted this. I only knew of the problem when I saw something strange from a Slashdot article - I've never been a security geek anyway. The people who organized the Wall of Sheep in DEFCON must have known this well before this month, they probably knew it last year - those are the real security people.

It's actually quite worrying how little effort it takes for some random geek to "discover" a problem like this. If I can get it from Slashdot, what about the wardriving guy running Kismet in his car?

Faisal Asif said...

Any updates? Is it fixed already or still in process?

cirrus said...

At least it is good to see that some developers do care.
More applications that use plaintext authentication can be found at: http://blog.0x0lab.org/2010/04/unsafe-iphone-applications/

Anonymous said...

Foursquare promised an iPhone app update within a week, and there has been nothing yet. Not very impressed.

naveen said...

The app has been updated. Please get 1.9.2 in the store now (we had to wait for the approval process to go through).

naveen
co-founder, foursquare

Anonymous said...

There many usefull. I wanna say that information are very interesting. Try to be gere more often

Anonymous said...

I always emailеԁ this website pοst
ρаge to all my friends, since if liκe to reаԁ it
nеxt my cοntacts will too.
My web-site ; http://instagram-follower.com

Anonymous said...

Thаnκ уou a bunch foг sharing this with аll of uѕ you aсtually realize ωhat you're speaking approximately! Bookmarked. Please also consult with my website =). We could have a link exchange contract between us

Here is my blog http://vietfriendship.net/member.php?u=1084662
Feel free to visit my blog post : mzi

Anonymous said...

top [url=http://www.c-online-casino.co.uk/]free casino bonus[/url] hinder the latest [url=http://www.realcazinoz.com/]free casino bonus[/url] autonomous no store reward at the foremost [url=http://www.baywatchcasino.com/]bay anticipate casino
[/url].

Anonymous said...

[url=http://www.bestnikeaustore.com/#ufwm798]Nike Shoes Online[/url] [url=http://www.lovenikenz.com/#uotd263]Nike NZ[/url]
irvrn lpfrxft uqo fd ujaas rkem ycz ?
04 [url=http://www.lovenikenz.com/#Nike-Free]Nike Free[/url]

Anonymous said...

bookmarked!!, I like your blog!

Also visit my web blog: build followers on twitter
Feel free to visit my webpage ; twitter followers for free

Anonymous said...

Keep this going please, great job!

Here is my page - http://www.vapornine.com/

Anonymous said...

beautifulblogcom
http://www.buchmatrix.de/content/simple-complementaire-sante-secrets-and-techniques-information
http://infinitydesign.ie/content/review-critical-elements-within-comparatif-mutuelle
http://www.inthesameboat.net/node/187513

Anonymous said...

easy methods to launch a fantastic weblog
http://www.arabic-media.de/index.php?do=/blog/101731/evaluating-authentic-assurance-santé-goods/
http://jumpingforfunaroundtheworld.com/node/303259/
http://www.hpe-muenchen.de/node/148029

Anonymous said...

your blog is without a doubt nsfw pixel
http://pioneropkm.com/web/node/44163/
http://www.philipstorm.me/blogs/entry/Effortless-Programs-Involving-mutuelle
http://www.okotobrigyadance.com/node/587763

Anonymous said...

May I just say what a comfort to discover someone that truly understands what they're discussing on the net. You definitely know how to bring a problem to light and make it important. More people should check this out and understand this side of the story. I was surprised you are not more popular because you most certainly have the gift.

Feel free to surf to my website ... zulutrade

Anonymous said...

Hello friends, its great paragraph on the topic of educationand entirely
explained, keep it up all the time.

Feel free to surf to my page: more followers on twitter free

Anonymous said...

Hi colleagues, how is everything, and what you want to say concerning this piece of writing, in
my view its genuinely awesome designed for me.

Also visit my page ... aaa fx
Also see my website :: http://aaafx.livejournal.com/709.html

Anonymous said...

I believe what you published was actually very logical.

But, what about this? suppose you composed
a catchier post title? I ain't suggesting your information isn't solid,
but suppose you added something that grabbed people's attention? I mean "Foursquare considered harmful - DON'T
USE [Updated w/ 4sq's reply]" is kinda boring. You might peek at Yahoo's home page and watch how they create news titles to get viewers to open the links. You might add a video or a pic or two to get people interested about everything've written. In my opinion, it might make your blog a little livelier.

Feel free to surf to my site ... add twitter followers

Anonymous said...

I couldn't refrain from commenting. Well written!

My blog; get followers

Anonymous said...

This page really has all the info I wanted about this subject
and didn't know who to ask.

Check out my site: option fair

Anonymous said...

I always emailed this blog post page to all my contacts, as if like to read it afterward my links will too.



Here is my blog post ava fx
Also see my web site: ava fx

Anonymous said...

just stopping by to say hi

Anonymous said...

We [url=http://www.singapore-casino.ws/]casinos online[/url] be subjected to a large library of utterly unconditional casino games in regard to you to sport privilege here in your browser. Whether you pine for to practice a table game master plan or just attempt elsewhere a some original slots before playing seeking unfeigned in clover, we be undergoing you covered. These are the claim still and all games that you can engage at true online casinos and you can with them all representing free.

Anonymous said...

Pretty section of content. I juѕt stumblеd uρon
your sіte and in accessiοn capіtal tο asѕert that I acquire actually enjoyeԁ аccоunt yоur blοg
posts. Anyway Ӏ will be subsсribіng to your augmеnt аnԁ eνen I achіеvement уou access consistently fast.


Αlso viѕit my ωeb site :: raspberry ketone uk

Anonymous said...

Hi mates, how is the whole thing, and what you desire to say concerning this article, in my view
its truly remarkable for me.

Also visit my website; abboiler.com

Anonymous said...

Hi! Do you know if they make any plugins to safeguard against hackers?
I'm kinda paranoid about losing everything I've worked hard on.
Any recommendations?

Here is my web page: http://ziipons.net

Anonymous said...

simply speaking fantastic records weblog
http://spacefather.com/community/blog/view/735036/determining-appropriate-equipment-on-face-painter
http://www.tnasafetyoutreach.com/members/verona485/activity/122120/
http://assembleagroga.info/moodle/blog/index.php?postid=5675
http://socialcomputing.trojanifsc.net/wiki_fall2010/MarissanfKnottsxt
http://plusmodels.com/members/wolfgangc/activity/36959/

Anonymous said...

I like the valuable information you supply in your
articles. I'll bookmark your blog and check once more right here frequently. I'm somewhat certain I will be informed lots of new stuff proper here!
Good luck for the following!

my homepage - appellate Law Firm

Anonymous said...

I for all time emailed this website post page to all my friends, as if
like to read it after that my contacts will too.

my page - Help Desk Software Reviews

Anonymous said...

Apple [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
family that has already been with me for approximately The couple of years. even by way of me personally "closing" for the [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
few one month to begin more than. Make delight in his or her child, that they pay on-time, they are simply nice in most cases incredibly accomodating. Mother can be described as [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton taschen[/url]
bit connected with [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton Taschen, Ihre Luxus-Experten[/url]
an airhead so i also have numerous miscommuication with your ex wife about a [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
few stuff nonetheless have the ability to really been practiced right now.
This [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton outlet[/url]
guards always conquer your man and infrequently fertilized your ex boyfriend. On the plus side, Bruce may protect your ex boyfriend, as well as the assistance of [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
some new built associates. Even, Bruce sneaks straight into a [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton outlet[/url]
Baron (extravagant) college as a way to learn, considering when you your [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
third young child some people don need you alive-none a considerably less would love you to sit and learn.
Dwell tweeting important Television programs situations. through the Excellent Dish towards the Grammy Honors. has grown to become engrained with our looking at at this point, growing the [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
virtual standard water refridgerator which has raised star ratings. However Oscars watch is specially interesting simply because it is an antidote on the on-screen, buttoned-down style. Its like there are no longer some sort of "SAP" tab on your own remote, yet your [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton outlet[/url]
"YUKS" a single, presenting to you play-by-play because of a number [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
the most humorous men and women the internet.
Michelangelo fresco "The [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
Last Judgment" spending time in just one connected with [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
the holiest parts in the Christian society -- typically the Sistine Rec center from the Vatican. His or her visuals and verse contains indirect referrals to help you homosexual marriage aspiration. As soon as "The [url=http://www.sreecgmath.org/louisvuittontaschen.php]Louis Vuitton[/url]
Last Judgment" was basically introduced, any Vatican condemned turning out to be indecent and even indecent.
Requires practical experience choosing exist function insurance plan, breakage reports. recording studio along with Harley-davidson construction, images not to mention on-line information insurance. Could watch over as well as engage in with regard to subject material about digital programs. Have to bring in happy newscast arrangement skills on your afternoon viewer.

Anonymous said...

In fact when someone doesn't be aware of after that its up to other users that they will assist, so here it occurs.

Also visit my web-site :: com.br

Anonymous said...

I constantly spent mу half an hour to гeаd thiѕ blog's posts everyday along with a mug of coffee.

my web-site: vistaprint coupon code

Anonymous said...

Hurrah! In the end I got a weblog from where I can really obtain helpful
information concerning my study and knowledge.

Here is my homepage - breast enhancement herbal pills

Anonymous said...

Superb, what a blog it is! This webpage gives helpful facts to us, keep it up.
ageless male -
ageless male - ageless male

My web blog: ageless male scam or not

Anonymous said...

Hey there superb website! Does running a blog
similar to this require a massive amount work? I have virtually no understanding of computer
programming however I was hoping to start my own blog in the near future.
Anyway, should you have any ideas or tips for new blog owners please share.
I understand this is off subject however I simply needed to ask.
Thank you! ageless male -
ageless male - ageless male

My webpage - ageless male

Anonymous said...

I like the valuable info you provide in your articles. I'll bookmark your weblog and check again here regularly. I'm quite sure I will learn many new stuff right here!
Best of luck for the next!

my homepage - Schools.Gmuca.Org

Anonymous said...

Hi there it's me, I am also visiting this site daily, this site is truly fastidious and the users are truly sharing good thoughts.

My homepage :: exercises to improve vertical jump

Anonymous said...

Hey there! I just wanted to ask if you ever have any problems with hackers?
My last blog (wordpress) was hacked and I ended up losing months of hard work due to
no back up. Do you have any methods to stop hackers?


Feel free to surf to my web site; treatments for yeast infections

Anonymous said...

Someone necessarily assist to make critically posts I would state.

That is the very first time I frequented your web page and
so far? I amazed with the research you made to create this particular submit incredible.
Great activity!

Also visit my page: mftot.jointokyo.org

Anonymous said...

Wow, marvelous blog format! How lengthy have you been running a
blog for? you make blogging glance easy. The
entire glance of your site is great, as smartly as the
content!

Check out my website: growth hormone releaser

Anonymous said...

I for all time emailed this weblog post page to all my contacts, as if like to read
it afterward my links will too.

my weblog; www.fx-mentors.com

Anonymous said...

Superb, what a web site it is! This website provides helpful facts to us, keep it up.


Stop by my site vacation village in the berkshires

Anonymous said...

Тhаnkѕ desіgnеd for shaгing such a good thinking, pіeсe
of wгitіng іs fаѕtіdiоus, thats why i hаve reаd іt completely

Look at my webpage; raspberry ketones gnc singapore

Anonymous said...

If some one wants to be updated with most recent technologies afterward he must be pay a visit this
web page and be up to date every day.

Feel free to visit my homepage ... the tao of badass

Anonymous said...

Hi, Neat post. There is an issue along with your website in web explorer, would check
this? IE nonetheless is the marketplace leader and a huge part of folks will leave out your fantastic writing because of this problem.


Also visit my blog - http://buyaltawhite.eklablog.com

Anonymous said...

I love your blog.. very nice colors & theme.
Did you make this website yourself or did you hire someone to do it for
you? Plz answer back as I'm looking to design my own blog and would like to know where u got this from. many thanks

My blog post - virility ex

Anonymous said...

Please let me know if you're looking for a article author for your site. You have some really great posts and I feel I would be a good asset. If you ever want to take some of the load off, I'd love to write some material
for your blog in exchange for a link back to mine. Please send
me an email if interested. Cheers!

My homepage :: venapro Reviews

Anonymous said...

Thank you, I have recently been searching
for information about this topic for a long time
and yours is the best I've discovered so far. However, what concerning the conclusion? Are you sure in regards to the supply?

Have a look at my blog; Kitcheninlove.It

Anonymous said...

Кабельная продукция - один из основных продуктов, используемых для полнофункциональной работы электрооборудования. Разнообразие моделей и марок кабеля на сайте ООО "Спецкомплект" Предлагают широкий выбор для оптового и розничного клиента.
Фирма предлагает массу качественных товаров, таких как КМГ, КМЗП, силовой кабель ВВГ, ВБбШВ, СИП, АСБ, ENSTO арматура СИП, оптический кабель ОКГ, ОКБ, ОКЛ, ОКК.
Сборка электро-щитового оборудования - ЩРНМ, ЩМП, ЯБПВУ высокого качества по доступной цене, смотрите обзор на сайте компании.
Specomplect Ru - [url=http://specomplect.ru]лотки НЛ[/url]

Anonymous said...

Возведение жилых и промышленных многоуровневых объектов влечет за собой привлечение специальной строительной техники, оснащенной для проведения конкретных задач. Исполнение строительных работ происходит по стадиям, в связи, с чем, задействовать строительную технику тоже приходится по шагам, в зависимости от назначенных задач.
Но покупка таковой специальной техники влечет огромные расходы. Поскольку стоит она дорого, компания "Сапрос" рекомендует услуги аренды строительной техники. Наш автопарк укомплектован всем важным для строительства автотранспортом. Моментальный заказ спецтехники можно создать через интернет, заполнив заявку онлайн на сайте компании. В Самаре мы пользуемя популярностью именно за высококачесвенное и оперативное обслуживание посетителей, предоставляя такую услугу, как аренда бары. Наши специалисты при необходимости в полном объеме проконсультируют Вас о более подходящем под запросы автотранспорте, что позволит сэкономить и время и деньги.
Sapros Ru: [url=http://sapros.ru]аренда бары в самаре[/url]

Anonymous said...

At this time it sounds like BlogEngine is the top blogging platform out there right now.
(from what I've read) Is that what you're using on your blog?


Visit my blog virility ex ingredients

Anonymous said...

I am really delighted to read this weblog posts which carries tons of useful information,
thanks for providing these kinds of information.


My website :: byelizabeth.com

Anonymous said...

Hi Dear, are you truly visiting this web page on a regular basis, if so then you
will absolutely take nice knowledge.

Have a look at my homepage - venapro Prices

Anonymous said...

http://eekshop.com
Reason Six: You usually are happier than all your family members have ended up gorgeous honeymoons as well ages You are generally happier to have each of them is aspects having to do with your life. Your answerability regarding debt will decrease and to have a resource box your fears and for the long-lasting.

Anonymous said...

I've read several just right stuff here. Certainly price bookmarking for revisiting. I wonder how a lot attempt you set to create this kind of wonderful informative web site.

Feel free to surf to my web-site: home based business opportunities

Anonymous said...

I every time used to study piece of writing in news
papers but now as I am a user of web therefore from now I am using
net for articles, thanks to web.

My web blog :: übersetzung deutsch kroatisch

Anonymous said...

This is my first time pay a visit at here and i am truly happy to read
everthing at alone place.

Also visit my blog ... virility ex **

Anonymous said...

Тhis site wаs... how dо I ѕay іt?
Rеleѵant!! Finally ӏ've found something that helped me. Many thanks!

Here is my site - raspberry ketones

Anonymous said...

Why people ѕtіll make use of to read nеws pаpеrs
when іn this teсhnοlogical worlԁ all is prеsenteԁ on net?


Also vіsit my hοmepаge ... auto insurance rates