130: Jason's Pen Test

JACK: I used to work for this company, and I worked on the overnight shift,
and they had a parking garage. But the best parking spots were all assigned to
management. Not only that; you had to have a special parking garage badge to get in,
so I always had to park far away. What really bugged me is that I was on the night shift,
and there were only three of us on the night shift. So, it was like the whole parking
garage was empty. Well, one day I brought my skateboard to work and was just rolling around
in the parking garage during my break, and I rolled up to the mechanical arm that blocked
you from getting into the garage, and to my surprise, it opened as I rolled up to it. What?
I waited for it to go down and I tried again, and it opened when I got near it again. What I
discovered was that there was a little electronic eye which detected when a car was trying to exit
the parking garage, and it would lift the gate to let the car out. Well, I pinpointed exactly
where that eye was and just tried to do something like take my shoe off and place it in front of the
sensor, and sure enough, that was enough to get the gate to lift up until I moved my shoe. Well,
naturally I hopped in the car, drove up to the gate, got out of the car, took my shoe off,
put it on the exit sensor, and it raised the gate, and I got back in the car and was able
to get through the gate and grab my shoe on the way through, and just park wherever I wanted.
(INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m
Jack Rhysider. This is Darknet Diaries.
[INTRO MUSIC ENDS]
JACK: In this episode,
we’re gonna hear some stories from Jason Haddix.
JASON: I’ve always been into computers. I think I had my first computer when I was eleven or twelve.
I think my parents got it for me for Christmas. It was a 486. Kinda just taught myself ‘cause
I was curious about how it worked. A little bit of programming, HTML, and stuff like that.
JACK: Any dark stuff you were looking into back then or anything that was –
maybe your parents wouldn’t be happy you were seeing?
JASON: Yeah, yeah. So, I mean, when I was in my early, early twenties,
a friend of mine wanted a fake ID. We were all, you know, very young and impressionable
at the time. So, I went out and a friend of mine was selling fake IDs, and I bought one.
Back then it was a hundred and twenty bucks or something like that for a fake ID. I got
it eventually. It took a long time for him to get me one. Then when I got it,
it was really crappy. I was really upset and I figured hey, I could probably do a better job
than this if I just learned it, ‘cause I figured I knew computers and I knew stuff like that. So,
I just started Googling – back then it wasn’t really Google, but I just started looking on
the internet for resources. So, one of the resources that I fell upon was ShadowCrew,
which was probably one of the first darknet forums that was mainstream before the darknet actually
existed. It was still the regular web, but it was forums. I started learning how to do everything
to do with fake IDs; bought printers and learned how to make my own, and probably a couple for my
friends. But it involved asking a lot of questions with the underground then, which was ShadowCrew.
JACK: Okay, yeah, so Jason was on ShadowCrew, and if you aren’t familiar with ShadowCrew,
just go back and listen to the episode just before this, called Gollumfun. While Jason
was on ShadowCrew, he was focused on making fake IDs, but he really didn’t sell that many.
JASON: [MUSIC] I mean, I would say I only sold a handful. It was more of a obsession for me
to do it better than what I got. I’d say maybe three or four really good ones and a whole bunch
of failed ones for my personal use, like just for my friends, really. I wasn’t a distributor
even on the forums or rated, but I had shared a couple with people and they were like oh, these
are getting really, really good. Mine usually passed, so it wasn’t rocket science, right?
It was just having access to the printers, the templates, understanding all that kind of stuff.
So yeah, it wasn’t like I was a criminal enterprise that was making a lot of money
or anything like that. It was just that I found it really interesting.
You could fall into anything; you could fall into a video game or you could fall into some
kind of obsession like finishing a project. I had to figure out how to do it, and I did.
JACK: Then one day he goes onto ShadowCrew’s website and sees it’s been shut down.
JASON: The picture that they put up there with
the dude behind the bars – and said the Secret Service is coming for all of you
and a whole bunch of your – and then the indictment came out and a whole bunch of people
who – I really only knew their screen names, but had been arrested in multiple countries.
JACK: Well, this really spooked Jason. People were getting arrested for selling
fake IDs on this site, and he was one of the people selling fake IDs there.
JASON: The bust happened and then the next day I gathered – so, in the process of printing stuff,
you have three – usually three different printers, you have laminates, you have stencils, you have
powders, you have all kinds of crazy stuff; you have inks. As soon as I had it, I just
dumped it in a black trash bag, a couple black trash bags, threw it in my trunk, and drove.
JACK: [MUSIC] He was driving as fast as he could to another city far, far away. His plan was to
just throw it all into a dumpster nowhere near where he lived just to get rid of everything.
JASON: On the way to do that, I actually got pulled over.
JACK: Jason’s heart was pounding so hard. He didn’t know why the cop pulled him over. Maybe
it was for the fake IDs, and all that evidence was in the trunk of his car. The cop walked up to his
window and said he was speeding. This was somewhat of a relief, but Jason was still really worried.
JASON: I just thought he’s gonna ask me to pop my trunk and see all my stuff in the trunk.
JACK: But the cop didn’t. He just gave Jason a ticket and let him go. Whew, close call. So Jason
continued to drive to the next town, this time going a little slower, to get rid of his stuff.
JASON: Dumped it in the next city in a dumpster with some lighter fluid and lit it all on fire.
Yeah, that was probably one of the scariest moments of
my life. Like I said, it scared me straight.
JACK: Hm, that’s interesting, eh? That intimidating post that the Secret Service
put up on ShadowCrew’s site was enough to make Jason quit the fake ID scene forever.
It’s kind of hard to leave something like that behind. With ShadowCrew, it was like he was let
into some inner circle of people, almost like a family. It’s hard to build up something like
that and earn that trust just to walk away from it all and start over somewhere else.
Well, by this point, Jason had enough knowledge of computers that he knew
he wanted to make a career of it. He really liked the challenge of hacking into things,
too. So he took some classes and then got a job fixing computers, then became a junior
penetration tester. He did that for two years and then got another job doing penetration testing at
HP. This is where he was tasked at hacking into companies to see if they were secure.
JASON: So I started there as a staff penetration tester, did
probably a couple hundred pen tests for the Fortune 500, a lot of…
JACK: A couple hundred; that’s a lot.
JASON: Yeah, I mean, I’d say I’ve probably done over my career maybe three hundred pen
tests – or a little bit less than three hundred pen tests, probably, over the years. But yeah,
we did one-week assessments. You had one week for the assessment, one week for the reporting.
It was really easy for HP to get those contracts because they already had these big ins through
their IT group with these companies. They were selling them printers, they were selling them
enterprise software, and then everybody at that time needed – if they were subject to any kind
of compliance, they needed a pen test for clients to satisfy compliance. So, they would just go with
the people they already had a contract with, which was us. So, I got exposed to a ton of the big,
big banks, a ton of big tech companies, big enterprises. I pen tested a lot of stuff.
JACK: Ah, yes, compliance. I believe to be PCI compliant, it requires that
you have to have a penetration test. PCI is Payment Card Industry, so, like MasterCard,
American Express. They won’t let you process their credit cards unless you’re PCI compliant,
which means you have to have an auditor that comes to your company and analyses your security
practices and conducts a penetration test. I guess HP was one of those auditors and offered
this service, which is where Jason really honed his skills as a hacker. Now for the most part,
Jason focused on network hacking. There’s a few types of penetration testers; there’s physical
penetration testers where they physically try to get into a building to see what they can access,
but there’s also application pen testing. This is where maybe a software-maker gives
their application to you and you try to find a bug with it. Then there’s network penetration testing,
and this is where you try to break into a network using a computer, over the internet or whatever.
You might try attacking it from the outside world or you might be actually given permission
to come into the network and see what you can get to from inside the company. For instance,
the people who work in marketing shouldn’t be allowed to just see everyone’s passwords,
right? Someone should test that to see if it’s truly secure. Jason did a few physical pen tests
and there’s one he told me about, which is actually hilarious. [MUSIC] Okay, so you
know when you work somewhere, you get to know the security mechanisms that they have in place? Well,
Jason worked for this place for a while and he was pretty familiar with the layout of the
office and knew exactly how the doors worked in the building. Well, later on when he went to work
for another company, he was given the task of breaking into this previous employer. Since he
already knew the place well, he knew exactly what to bring. Okay, we need to get into this building.
JASON: Yeah.
JACK: Let me pack some equipment for this.
JASON: [LAUGHING] Yeah.
JACK: What do you throw in your bag?
JASON: Yeah, I mean, you throw your lockpicks,
you throw your USB keys that have malware on them, and you throw your blow-up doll.
JACK: Yeah, a blow-up doll. He knew there was a certain door that had a magnetic lock.
Nobody was allowed in or out unless the magnet was disengaged. Well, to get in, you need your badge,
which disengages the magnet, but to get out, you didn’t need your badge. You could just
open the door by pushing it from the inside. So how does the magnetic lock disengage for
people leaving? Well, it unlocks when it senses someone leaving. It had a little electronic eye
and could see when something got near the door on the inside, and it would unlock the
door. This was one thing he noticed, but he also noticed something else about this door.
JASON: The gap, the small, small gap between the door and the ground,
you could slide something under there.
JACK: [MUSIC] So when he was given this assignment, he packed a blow-up doll and
went right up to the door, pulled it out, which it was deflated and flat,
and he put it on the ground and slid it under the door. The whole doll was on the other side
of the door except for the part that you put your mouth on to blow it up, so he laid on the
ground and began blowing up the doll, which was inflating on the other side of the door.
JASON: That’s exactly what it is, just face on the pavement,
blowing up the blow-up doll. Yeah, for sure.
JACK: Then you hear the click of the door and you jump up and grab it.
JASON: Yeah, we had two people with us, so the other person would apply some slight pressure
as soon as a mock walked through the door, do the same thing – it was a man-trap door,
two sets of doors, so did the same thing on the other one and then walk
into the physical premises. Once you’re in there, you have access to everything.
JACK: I love this because to me, this is something I never would have expected someone to bring on a
physical pen test. To take pictures of it and to put it in the report must have been hilarious.
There was this other physical pen test that he did that also had an interesting bit to
it. His objective in this one was to break into the building and see if he could get
into the server room. It was him and two others on this assignment. Now,
these server rooms are typically more secure than the rest of the building.
It usually has a different kind of key to get in and cameras pointed at the door,
and more security layers. Well, step one was to get into the building, and there was
a locked door to get into the building, so they simply waited until someone was going
in and they just went in right behind them and just tailgated them right in through the door.
[MUSIC] That worked; they got in the building. They scoped the place out and they figured out
where the server room was, and they didn’t see an immediate way in, but they had some
ideas. It just wasn’t gonna be easy. The blow-up doll trick was not gonna work here,
and you could try picking the lock to get in, but that takes a while, maybe ten minutes or longer,
and it’s just too much time to be standing there, probably on camera, trying to force
open the door. So, they got an idea to just hide in the office somewhere and wait for everyone to
go home for the night. So they ducked into a little room and just waited for a few hours.
JASON: Until everybody was out, and then the objective was to get
into the server room. The server room was segregated from some of the other offices
basically with a locked door. We didn’t have the correct technology to clone a card. We weren’t
successful to clone a card of an employee to – the right kind of employee to get into the
server room, so we were kind of at our limit of trying to reach the objective for the test. So,
what we had noticed is that the ceiling tiles – if you look at any building, their ceiling tiles
allow some space to run wiring and air conditioning up above. There was a small
table outside of the door of the IT server room, which had some flowers on it. So we
were like, I wonder if we – if there’s any gap to try to crawl over the wall boundary.
[MUSIC] I was probably the lowest on the totem pole at this point with the company I was working
at, and so they convinced me to climb up into the ceiling tiles. Climbed up, pulled myself up
through the beaming part into the crawlspace above the door divider, and crawled over. I had been
pretty careful to keep on the metal divider parts that hold the ceiling tiles on, and those are more
stable. They hold a little bit of weight. But on one of them – once I was over into that area,
I put my knee down on the wrong area and promptly fell through the ceiling into the server room
flat on my stomach. Knocked the air of me. I kinda thought I was gonna die. It’s like,
catch my breath, kinda make sure nothing was broken. Luckily nothing was.
JACK: Did anybody shout, like, you okay over there?
JASON: Yeah. I mean, yeah. After, I think the response was ‘oh shit’ as
soon as they heard the cracking – or the tile crack through.
I can’t really remember ‘cause I was falling and still on the floor kinda dazed, but
I’m sure one of them cared about my safety at the time. Then they were wondering if I could open the
door from the inside, which I could. Reached the objective in the end, which was nice. So, yeah.
JACK: He was okay; bruised, shook up a bit, but okay, and he was lucky he didn’t fall onto any
server racks or sharp objects. He landed just on the empty floor, and he was also lucky he didn’t
land on any computers and pulled out cords or caused an outage or something. Anyway,
after that, he was able to get into a bunch of those servers and prove how someone can get into
their servers. If you step back and look at it, he essentially walked in off the street and got
into the computer room and gained full access to their main systems there, and he only broke
a few ceiling tiles doing it. The customer was happy to have this report. It wasn’t a big deal
to replace the tiles, and this showed them the importance of having walls up in the ceiling to
prevent people from getting in that way. Now, even though Jason has done a few physical pen tests,
the majority of pen tests he’s done have been network-based. That is, trying to get into the
main website or network by just using a computer. One time, he was tasked with hacking into a bank.
JASON: [MUSIC] Yeah, absolutely. So, we were contracted to do a pen test on a large bank,
a worldwide-present bank, and we had a big contract with this bank. When I say we,
it was me and one other tester at the time working on this project, and one was the network and web
portion of the penetration test, and the other was their new mobile app and their mobile application.
JACK: He was tasked with examining the mobile banking app to see if he can get
any customer information or sensitive information from the app itself.
Have you tried using these mobile banking apps? Do you get a weird feeling about it like I do?
Something about having my bank details in my pocket doesn’t sit right with me. It seems
silly since pretty much everything else is in my pocket, but throwing my bank account in there too?
I’ve always been very hesitant of this. It’s kind of the same feeling of when I was doing
online shopping for the first time and I was asked to give my credit card into a website. I was like,
no way am I doing that. Well, years later, that’s the main way I shop now. But my
favorite definition of the term ‘information security’ is to enable business to be conducted
safely in a hostile environment. The internet is a hostile environment,
and clearly if a bank wants to come out with a mobile banking app, they better have someone
securing this app so business can be conducted safely. Well, this is what Jason was tasked
with doing. He was going to act hostile to the app to see if it exposed any data it shouldn’t.
JASON: We started doing recon on them. We had found a whole bunch
of web servers and stuff like that, and we had their mobile…
JACK: So, I understand what recon is for a physical pen test, right? We’re going
to Google Maps, we’re looking on LinkedIn, seeing what kind of employees there are.
JASON: Yeah.
JACK: But what kind of recon is there for a web app pen test or a mobile app pen test?
JASON: Absolutely. So, this is kinda my specialty, I would say, inside of the hacking scene. I’m kind
of the godfather of reconnaissance for web applications and I’ve written multiple talks
about it. So basically you have to think about a company as – especially a big company like
this one, like a bank, they have hundreds if not bordering on thousands of publicly-exposed
web servers. You know of the one; you know of www.bank.com, right, that you log into
and maybe a couple other ones. So, you have to basically find them. So, the act of recon
for a bank or any big web entity is basically finding all of their assets that are connected
to the internet. So, there’s a number of methods that you can use to do this.
You can use search engines to find other sites of theirs that are online. You can do
things like searches for their privacy policy in terms of service, you can brute-force subdomain
names. So, if you’re looking at www.bank.com, you can check to see if admin.bank.com exists with the
DNS registrars or just trying to resolve it. If you get a response, that means it resolves and you
can go to that web page and possible check out sites like that. So, you can brute-force
different names if you have a long list of different names that could exist, which we did.
JACK: So, after finding all the domains, the next step is learning what you can do with
those domains. Where are they hosted? What kind of applications are running on them? Do they have
any default credentials or known vulnerabilities? A vulnerability scanner can pick up some of this,
but it’s also good to kinda look through every domain individually and see if
anything pops out at you. Jason was on this engagement with another person on his team,
and they decided to split the work. Jason was gonna look at the mobile
app while his coworker would continue to look at the domains they found.
JASON: So, for the first week I was just kind of looking at the app,
trying to figure out how it worked, and at that time there was a new feature of
the mobile app for this bank that you could take a picture of a check and deposit it.
JACK: [MUSIC] Oh yeah, I’ve seen this feature. Instead of running down to the
bank to deposit a check, you can just take a picture of it on your phone and
the app will deposit the check into your account. This feature always
seemed suspicious to me. You just need a photo of the check, not the actual thing,
and you have to enter the amount you’re depositing? What’s stopping you from depositing
the same check twice or entering in whatever amount you like? There’s lots to test here,
and there must be a whole slough of new attack vectors when a feature like this rolls out, right?
JASON: I was looking at this app and I was capturing the traffic that went from
the mobile app to the servers that took care of the processing of the image of the check.
JACK: Okay, that’s a good place to start. When you send the bank a check pic, where does it go?
JASON: I was proxing the web traffic between the phone and the web server with an interception
proxy like Burp Suite. So, it’s a common tool for web hackers; it just lets you see the traffic
between websites and your browser or websites and your mobile phone. So, what it did first is
it took the image of the check and then turned it into binary representation of the image, and
then sends it across an API which at the end was uploaded – was reconstructed and put on a server.
JACK: The server that it went to was an AWS storage bucket. This is Amazon’s Cloud
storage. So, check images were being sent to this storage place, and as Jason continued to watch
the traffic, he was able to identify exactly which storage bucket on AWS these checks were stored in.
JASON: So, you could just visit the back end and there was a whole bunch of images
of checks just in this directory. So, that is a little bit more of a privacy breach, right?
JACK: Yeah, so…
JASON: Yeah.
JACK: Are you talking about an open AWS bucket that anybody can visit?
JASON: Yes, and because this was the first iteration of this feature and that was when AWS
was still in its young years, yeah, absolutely it was an open AWS S3 bucket of check images.
JACK: [MUSIC] Whoa, this is bad. An open AWS bucket means the entire contents of that storage
bucket is available for anyone to see. They could see everything on there. Now, in some cases,
this is fine. For instance, darknetdiaries.com is hosted on AWS, and the whole bucket is open
and visible for anyone to see. But I don’t have any private data on there; there’s no user data,
there’s no back end database. Everything is supposed to be visible to the world.
But I don’t think it’s a good idea for a bank to store all their cashed checks
through the mobile app in an open AWS bucket. Anyone can see all the cashed
checks. Jason was looking at these checks and just couldn’t believe it.
JASON: There was about two million checks in this instance. So,
lots of checks, and each one has your address printed on it and your account number,
which is considered somewhat private data, and the banks are supposed to protect that.
If you’ve ever seen the gif of when Tiger Woods would score a good swing or something like that
on a golf course, he does the little – closes his fist and it’s like a little fist bump in the air
or whatever. That’s my default pen test move when I find something critical. In this case it exposed
names, addresses, account numbers, and transaction history for users using this feature. So,
it was a decent-sized finding. It wasn’t the most critical ever, but it was a decent-sized finding.
Really, the first thing is you get kinda hot and sweaty and you’re like alright, sweet,
I think I have something. This is really great. You get a little nervous because if you’ve been
a pen tester for a long time, you know that they’re probably monitoring the network and
at any given time you could lose access to something that’s good, so the first
thing you do is take many screenshots of the traffic that you have and the vulnerability,
and take – so you have images for your report at the end. So, I started doing all that,
started making sure I gathered all the evidence in case I needed to prove out that it actually
existed in case they ghost-patched it or something like that. So, yeah, those are the feelings. But
when you hit a bank like this, especially one that has a big, big name, it’s pretty exhilarating.
Yeah, that’s the whole reason you get into pen testing, is to find big finds like that.
JACK: Okay, so that’s a big deal. He’ll want to tell them about that for sure and get them
to lock down access to that. But he wasn’t done testing; this mobile app was for iPhone,
so he grabbed the app off the phone and moved it to a computer to analyze. One of
the first things he looked at was the PLIST file. This lists the properties of the app,
and here you might find things like server names or information where data is stored on
the phone. [MUSIC] But as he looked through the PLIST file, he found some hard-coded credentials,
a username and password used to authenticate to something like an API or database.
JASON: We had found a server that had a default install of Apache,
and the manager console was open to the internet, so /manager, /HTML. So,
we used credentials that we had found hard-coded in the mobile app, which happens all the time.
People hard-code credentials in mobile app PLISTs even to this day and use it just as – on a whim,
right? I normally wouldn’t have tried this, but I just tried it to make sure on this manager console
to see if maybe the admin was the same of the service or whatever, and it turned out it was. So,
we used these hard-coded credentials that were in the mobile app that we were able
to reverse out on this website, and got into that. JACK: [MUSIC] A-ha; web admin access to the server
had been obtained. Amazing. Now, this web server was running something called Tomcat, which as an
admin you could upload stuff to it, so Jason just uploaded a payload using Metasploit to it, which
gave him command line or operating-system-level access to this web server. It’s one thing to be
able to log into a website as an admin, but you gain a whole new level of power when you
can get into the operating system as an admin, which is what he was able to do at this bank.
JASON: Then once you have a foothold like that, we were able to start scanning
internal – some internal IPs that connected to that server on more internal IP space of theirs,
so inside their company, as well as see a whole bunch of transaction data and customer data on
this server that we had exploited. So, it was a second really big finding. It had – I can’t
really talk about too much of it ‘cause it’s – a lot of this stuff’s covered under an NDA,
so – but it had client names, transaction data, a whole bunch of stuff on there as well. So,
we had two ways to really breach customer data on their network.
JACK: This was quite the report they submitted to the client. The bank was pretty happy that Jason
found all these problems, and they got the entire mobile development team on the call and had Jason
explain to them exactly what he found and how to fix this. They were surprised, but they all
agreed this is very important stuff to fix. We have one more penetration test story from Jason,
and you’re gonna want to hear this one, but we’re gonna take a quick break first, so stay with us.
Jason Haddix has pen tested hundreds of websites in his professional career,
and one stands out as particularly interesting.
JASON: Okay so, this one’s one of the ones that is interesting. A buddy of mine had taken on some
pen test contracts and he had taken on one too many. He basically had hit me up and said hey,
do you want to do a moonlight test? A moonlight test is basically I already have a job,
but he can give me a contracting gig on testing a site. I said yeah, sure, why not? So, he forwarded
me the info for the site and it turned out to be a pornography site. But not just a pornography site;
it was a site that had a store for items related to sex toys and stuff like that. It had private
cam access to view live workers doing their thing, and then also prerecorded videos. It had messaging
systems for you to chat with the cam people and all kinds of stuff. So, it was a big site.
So, he sent over the contract and I took it. The funny parts about this are the first thing I did
was I had to go to my wife and be like hey, you’re gonna – you might see some weird stuff
on my computer if you walk by. It’s for work, I swear, because there’s just a lot of graphic
stuff in the nature of testing this site. So, I had to give her a disclaimer upfront.
But yeah, so, I went through my normal methodology starting out, and I registered to the website.
[MUSIC] The client had really set a goal of getting access to this one account
on the site, and so that was the goal of the majority of it, was to get access to this one
account which had a private picture in it. If you get access to the picture, he would have
considered that a success because no one was ever supposed to have access to that picture.
JACK: So this was a user account or a camgirl account or…?
JASON: It was a camgirl account with messages and pictures associated to it. So, the way the
site worked is you could watch live cams, and then pictures that you had taken – kind of like
Patreon or any of those other services, you could pay to access specific pictures, too. So, he had
set up a picture in the picture section that he wanted us to access, and it would show that we
had unauthorized access for one of his – I don’t know if it was a real or a fictitious camgirl.
JACK: So, it sounds like
security so that nobody steals our – nobody gets unauthorized access to the paid content…
JASON: To the content, yeah.
JACK: Like, don’t…
JASON: He was really worried about that.
JACK: It’s kind of a funny objective ‘cause it’s not like, make sure our stuff’s secure.
JASON: Yeah.
JACK: It’s hey, make sure no one’s stealing…
JASON: I guess you could see it…
JACK: …like, going around the paywall.
JASON: I guess you could see it either way, right? You could see it like he wanted to
protect the integrity of the workers and he cared more about the workers than the
– or the content creators or – more than the users of the site. But no, no, absolutely,
you could see it in the dark way of just like he’s trying to protect his bottom line,
for sure. Yeah. So yeah, so I started creating an account, [MUSIC] just my own account to be
a content creator on the site. I uploaded some – just random photos into the photo storage area.
There was the store as well, so I purchased an item, I sent some DMs, and I’m – this whole time,
I’m capturing all this web traffic through a proxy and seeing what calls get made and then just
noting down how each one happened. So, the first thing that I noticed was that when you set up your
account – and it’s common for some sites to not really care about this – was that the password
policy was pretty much whatever you wanted it to be. So, for this site, when you basically
signed up to be a user or a creator, it was five characters minimum and no special characters or
numbers required. You could just make it whatever you want as long as it was five characters.
JACK: Okay, so a five-character password minimum is pretty weak.
But that’s only a suggestion to improve at this point. It’s like a theoretical issue, and it
would be nice if he could demonstrate how that’s a real problem. If he had a list of user accounts,
he could try to brute-force their passwords and see if anyone had a five-character password.
But he didn’t have that. Next, what he did was he tried to see how the site handled password resets,
so he initiated one. What the site did was it reset his password and then e-mailed him
this new password. [MUSIC] But he noticed the password that the site created for him was a
five-character password, and every time he’d reset the password, it was always five characters. Well,
to a hacker like Jason, he started thinking how he could use this to his advantage.
JASON: Basically you could start a password reset for any user on the site,
any e-mail address, and I had – he gave us the e-mail address for the
account he wanted us to target. Then you could brute-force the five characters
that it was using, because it was minimum five characters and the password reset would only set
a five-character password. You could brute-force that in about fifteen minutes. So, I went through
every character in about fifteen minutes. There was a small rate limit required, but it
wasn’t overly complex to bypass the rate limit. Eventually, right away on the test, broke into
the account with the image that he wanted through the password reset and the weak password policy.
JACK: What’s the tool you used to do that?
JASON: I did it in Burp Suite, which is a interception proxy.
JACK: But what you’re doing is you’re going to the website,
logging with that e-mail address, and then typing in a random five-character password…
JASON: Yep.
JACK: …and then again and again and again?
JASON: Yep. So, every combination of 1,
0 – or 00000 through 99999 and trying every combination between
that number, and basically keep on trying over and over again once I did the password reset, because
it reset it from what they had chose originally. So, that was the first really easy one.
JACK: So, Burp – I didn’t know Burp Suite did that, just keep trying passwords.
JASON: Yeah, so you can – in Burp Suite they have a tool called Intruder, and Intruder
basically can capture a web request and then you can highlight a section you want to edit
and load a list or a rule to try a whole bunch of different requests. So,
basically I captured the request for a regular login, or – yeah, a regular login,
and then highlighted the area where the password was and then told it to try everything between
00000 and 99999. It just ran all over those requests, added a small little wait in-between
each one, and then eventually you know which one hits when there’s a difference response
time from the server. So, you just wait until you see the different response time from the server.
JACK: Well, that was easy. He was able to gain access to the account that he was asked to try
to get into. This is fascinating to me because by and large, this is the top thing I get people
asking me to help them hack. I am constantly getting hit up on my DMs of people wanting me
to help them hack into something, and I’m like ooh, what are we gonna do, hack into a bank or
free someone from prison? They’re like oh no, sir, I need you to hack into my girlfriend’s account on
social media. There’s always a ton of people who are trying to get into someone else’s account.
Here’s a rather easy way to just get into anyone’s account on this porn site; reset their password,
then brute-force it. It’s just a five-character password and it’ll take fifteen minutes to do.
Imagine taking over the accounts of the top earners on this site.
JASON: What’s interesting is that password complexity is a really touchy topic for websites,
right? Your bank obviously has password complexity and makes you add special characters
and a minimum number of characters and stuff like that. But content sites that basically –
they don’t deem access to your account super-private, or they deem it private
but they want the least amount of friction for users to get into their account. Sometimes they
choose this on purpose. When we talked to the guy on the out-call, which is several steps ahead
‘cause we did many other things to this site, but when we talked to this guy on the out-call,
he knew that the password complexity was weak and he had kept it weak on purpose because it
offered less friction for his users to get into their accounts. So it was like a personal thing.
So, he ended up having to change the complexity of the password requirement for users and for
content creators, and then also had to change the flow for the Forgot Password
as well so it wouldn’t just set one; it would give you the link like normal sites do and
then send you to a page to change your own password to something you want to set it to.
JACK: Okay, so if you could reset the password and take over any user account on this site,
which user should you take control over next?
JASON: We found our guy’s admin account as well. [MUSIC] It was literally admin@thecompany.com,
and we reset his password and logged into his account, which had superuser access as well.
So, we could see pretty much the back end of the site as well from a management point of view,
which was really interesting ‘cause he had way more functions available to him than anybody else.
JACK: I mean, he would see that his password was reset. That’s strange; I didn’t do that.
JASON: Not if you do it at 3:00 AM his time.
JACK: Is that what you did?
JASON: Yeah, yeah. Yeah, so you do it – we waited until late at night. So, yeah.
JACK: Tricky.
JASON: Yeah.
JACK: But that’s what you gotta do.
JASON: That’s what you gotta do, yeah.
JACK: He also found a pretty clever bug about uploading images. This site allowed users,
especially camgirls, to upload content. Jason made an account and uploaded an image and watched
how the server handled it. Well, it tagged him in the upload request. So, he tried to upload
another image, but this time tagging another user to see if that did anything. The server took that
as another user has uploaded this. So, he found a way to upload images to other users’ accounts
on the site, which is interesting; you could deface someone else’s account this way, putting
all kinds of images and stuff on their account that others would see when they visited it.
JASON: We had found a couple of cross-site scripting bugs, and then we had also managed to
accomplish seeing the paid streams for the users without paying for them. You could look at the
source code of the HTML when you were attempting to look at somebody’s paid stream. Normally you
would click a button and pay with your credit card to access the paid stream. There was a parameter
in there called debug that was set to False. When you set it to True, you were able to access the
stream without paying for it. So, that was another way that we could bypass the paid nature. So at
this point, we could reset anybody’s password and take over their account. We had access to the back
end admin site, we had cross-site scripting, we could view streams without paying for them.
We pretty much had everything that we kinda thought, but then also in the store – we had
been working on the store and towards the end of the week, we had found that there was an SQL
injection bug that allowed us to dump the complete database, purchases and credit card data for
everything that had been ordered on his store that was associated to the site, which is not only just
sensitive ‘cause you have credit card data, but also sensitive because these are very sensitive
purchase of a very sensitive nature. So, we had all that transaction data as well. So, that was
that test, and there’s a lot of things I learned from that test about that
industry and stuff like that. It was really interesting and cool.
JACK: Huh, sounds like this site had a lot of security problems. You might not immediately
think of why it’s so important to secure a porn site, but one of the other things that
this site allowed users to do was hook up with each other. It’s reminiscent of this scandal.
HOST: A major hack tonight is threatening to expose embarrassing information on millions of
people around the world. They all signed up for a website named Ashley Madison,
which helps married people find people who want to cheat with them.
JACK: This was a news clip from CBS Los Angeles. The site Jason worked on was a competitor to
Ashley Madison, and he did this pen test just before Ashley Madison had their breach. If it
wasn’t for Jason finding these security issues, this site could have easily been the story on
everyone’s nightly news. The reason why that story was so scandalous was because it was
very embarrassing for a lot of high-profile people who were found to be users on the site. In fact,
I believe two people committed suicide for having their details exposed in the Ashley
Madison breach. So, it’s wild to think how Jason may have really saved not only the reputation of
this company by detecting these bugs before someone else did, but also potentially saving
the lives of some of its users. Maybe that’s a stretch. If you were Jason at the early 20’s
on ShadowCrew and you saw – you looked into the future, a crystal ball, and you saw Jason
doing that sort of stuff when he’s older, I wonder what young Jason would have thought.
JASON: I mean, he would have thought it was pretty cool, honestly. He hadn’t had years of
professional experience, though, to temper his excitement and do bad things. So, yeah, I mean…
JACK: Yeah, it’s an interesting perspective.
JASON: It is.
JACK: You looking back at that young Jason, young Jason doing dumb stuff,
but young Jason looking up at older Jason;
older Jason’s doing really cool stuff, yet young Jason thinks he’s doing cool stuff.
JASON: Yeah, yeah. Yeah, so…
JACK: And it’s weird to think that young Jason thinks young Jason is cool and
old Jason is cool, but old Jason thinks old Jason’s cool but young Jason’s not.
JASON: Yeah. That was a lot of Jason, but yeah, absolutely. Absolutely true. I’m lucky I have
that perspective now, though, right, and got paid well for that test. So, yeah, it is really
– I hate to be a shill, right, but penetration testing and security testing nowadays and having
all of the protection we have and being able to do it as a job is one of the most coolest fucking
jobs that you can have. I’ll never get over it. A lot of people talk about oh, you graduate out
of it. I don’t think I will ever graduate out of be – wanting to pop systems in some way. So, yeah.
(OUTRO): [OUTRO MUSIC] A big thank you to Jason Haddix for coming on the show and telling us
these stories. You can follow him on Twitter; his name there is @JHaddix. This show is made by me,
the slow poker, Jack Rhysider. This episode was assembled by Tristan
Ledger and mixing done by Proximity Sound. Our theme music is done by the abnormie,
Breakmaster Cylinder. The only dates I get these days are updates. This is Darknet Diaries.