News for hackers. Stuff that matters.

A comment on Pro-Trump social media app hacked on launch day as half million sign up. Parent comment

Re:Pro-Trump social media app hacked on launch day as half m... by input_sh on Monday July 05, 2021 @09:13AM (#27737616)
Funny you should mention that, but it's both. Both got hacked.

Gab's was a result of a patch they've made on top of Mastodon. Since Mastodon's license required them to share the code, here's a commit that introduced it (https://github.com/d0nk/gab-social/commit/fb3b7545705153022c...). They've since "fixed" the problem by sharing just an archive of the code, and password protecting it with "JesusChristIsKingTrumpWonTheElection").

I find it quite hilarious.

[ Parent | on HN ]
Re:Pro-Trump social media app hacked on launch day as half m... by kyrra on Monday July 05, 2021 @09:26AM (#27737748)
What was wrong with that change that allowed them to get hacked?

Edit, can I guess that this isn't how to do proper sql parameterized input?

> s.account_id = #{@id}

I don't know ruby at all...

[ Parent | on HN ]
Re:Pro-Trump social media app hacked on launch day as half m... by rsynnott on Monday July 05, 2021 @09:38AM (#27737842)
Something along the lines of

"https://thewebsite.com/the_url?max_id=); DROP TABLE orange_face_paint ; [.. make the remainder valid sql here]"

I would think. Essentially, it allows user-provided input to do anything; it's the most trivial form of SQL injection vulnerability.

[ Parent | on HN ]
Re:Pro-Trump social media app hacked on launch day as half m... by the_snooze on Monday July 05, 2021 @09:18AM (#27737656)
>"JesusChristIsKingTrumpWonTheElection"

Very un-Christian of them to be spreading straight up lies.

[ Parent | on HN ]
Re:Pro-Trump social media app hacked on launch day as half m... by umanwizard on Monday July 05, 2021 @09:23AM (#27737708)
Well, presumably they genuinely believe it to be true.
[ Parent | on HN ]