Hackers Chronicle - Online Cyber Security News: Information Disclosure

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1MQ1IHxLKVBVkwVdLs7a8UFYWzfculesftL6aqsnEVjTJtTZxijQIUMUGr86UALuIPPpYO__4yh8g2KxlWnf79XsLMsPnxFivQwgoKPXxsksF3HBBEVqkveb7mUg3OktFr7QTVYgiVYuN/s1600/Hotspot-Shield-Information-Disclosure.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hotspot Shield can expose VPN users locations" border="0" data-original-height="400" data-original-width="1200" height="211" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1MQ1IHxLKVBVkwVdLs7a8UFYWzfculesftL6aqsnEVjTJtTZxijQIUMUGr86UALuIPPpYO__4yh8g2KxlWnf79XsLMsPnxFivQwgoKPXxsksF3HBBEVqkveb7mUg3OktFr7QTVYgiVYuN/s640/Hotspot-Shield-Information-Disclosure.jpg" title="Hotspot Shield can expose VPN users locations" width="640" /></a></div>
<br />
A security researcher has found that one of the world’s largest <a href="http://www.hackerschronicle.com/search/label/VPN" target="_blank">Virtual Private Network (VPN)</a> providers is leaking users private information. Hotspot Shield, which has been downloaded over half a billion times and has been in operation for over a decade, has a bug which can reveal what country a user is located in, as well as leak the name of the WiFi network they are using. The <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerability </a>in Hotspot Shield’s VPN service was discovered by Paulos Yibelo. Yibelo reported his findings to Beyond Security’s SecuriTeam Secure Disclosure program.<br />
<br />
“By <a href="http://www.hackerschronicle.com/search/label/Information%20Disclosure" target="_blank">disclosing information</a> such as WiFi name, an attacker can easily narrow down or pinpoint where the victim is located,” Paulos Yibelo told. When an attacker knows what country a Hotspot Shield VPN user is from, they “can narrow down a list of places” their victim is from, Yibelo said. The vulnerability in Hotspot Shield’s VPN service was tested using a proof-of-concept code that Yibelo wrote. Using Yibelo’s code they were able to identify users WiFi networks, and the vulnerability kept working when tried from different computers and different network.<br />
<br />
Yibelo was able to write his proof-of-concept code very quickly, and it is only a few lines long. The code exploits a vulnerability in the local web server installed by Hotspot Shield. Private information and configuration data are returned when the exploit calls a JavaScript file being hosted on the web server. The private information of Hotspot Shield VPN users could be captured and stored from an infected website. According to Yibelo, he was able to successfully obtain Hotspot Shield VPN users IP addresses, though he was only having mixed results and was not always able to successfully capture real IP addresses. <br />
<br />
The developer of <b>Hotspot Shield VPN</b>, AnchorFree, Inc., is strongly denying that any user’s real IP addresses are being leaked through the vulnerability discovered by Paulos Yibelo. “We have reviewed and tested the researcher’s report. We have found that this vulnerability does not leak the user’s real IP address or any personal information, but may expose some generic information such as the user’s country. We are committed to the safety and security of our users, and will provide an update this week that will completely remove the component capable of leaking even generic information,” AnchorFree’s Tim Tsoriev said in a statement.<br />
<br />
After Yibelo discovered the vulnerability in Hotspot Shield VPN, he reported it to AnchorFree in December of last year but never received a response from the company. Yibelo then submitted the vulnerability to Beyond Security through their bug bounty program. Beyond Security also did not receive a response from AnchorFree. However, in February, AnchorFree finally addressed the issue with a new version of Hotspot Shield VPN which was recently released. The new version of Hotspot Shield VPN patches the vulnerability discovered by Yibelo.<br />
<br />
Last year Hotspot Shield VPN was accused by the Center for Democracy & Technology of selling their customers private information. A formal complaint was filed with the United States Federal Trade Commission (FTC) in which they allege that Hotspot Shield was guilty of employing unfair and deceptive trade practices. AnchorFree claimed that they did not collect any personal information about Hotspot Shield VPN users. Hotspot Shield VPN comes in both a free version, as well as a paid “Elite Version” subscription. The Center for Democracy & Technology discovered that Hotspot Shield VPN was sharing information after analyzing the VPN using Carnegie Mellon University’s Mobile App Privacy Compliance automated system on the free version of the Hotspot Shield VPN service.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIgJlWniS5CWuu5l9nx6AY0a6DcztXt31kP9dyM4R3vRFDyQBxwaypgNo5iSnJk6fKCcFbcR-mgk2WQqCbk5INRXlbfQUhDUHaijpiU0hsGWgcokJG_lto__jOucT4bLw1PnSYO0iMF5WL/s1600/HotSpot-Vulnerability-POC.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hotspot Shield Information Disclosure POC" border="0" data-original-height="253" data-original-width="645" height="249" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIgJlWniS5CWuu5l9nx6AY0a6DcztXt31kP9dyM4R3vRFDyQBxwaypgNo5iSnJk6fKCcFbcR-mgk2WQqCbk5INRXlbfQUhDUHaijpiU0hsGWgcokJG_lto__jOucT4bLw1PnSYO0iMF5WL/s640/HotSpot-Vulnerability-POC.PNG" title="Hotspot Shield Information Disclosure POC" width="640" /></a></div>
<br /></div>

A security researcher has found that one of the world’s largest Virtual Private Network (VPN) providers is leaking users private inform...

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuIwDgMNaan2uhQRa6VZRiUWTr7JTxgzIBKLz-HDBPC4RznLPMoODa6G5BeZfIo1MifcSy-nP72XWL_DHOY8DwNS8DiHOsRrkhGL1_ilr16MwDXTioCptQS659nbw7bwNvhKfBPK8iKaA/s1600/RCE-Information-Disclosure-and-XSS-Flaws-Found-in-PayPal-Partner-Program-Video.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="RCE, Information Disclosure and XSS Flaws Found in PayPal " border="0" height="218" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuIwDgMNaan2uhQRa6VZRiUWTr7JTxgzIBKLz-HDBPC4RznLPMoODa6G5BeZfIo1MifcSy-nP72XWL_DHOY8DwNS8DiHOsRrkhGL1_ilr16MwDXTioCptQS659nbw7bwNvhKfBPK8iKaA/s1600/RCE-Information-Disclosure-and-XSS-Flaws-Found-in-PayPal-Partner-Program-Video.jpg" title="RCE, Information Disclosure and XSS Flaws Found in PayPal " width="400" /></a></div>
<br />
A security expert has managed to identify three <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerabilities</a> on <a href="http://paypal-marketing.com/">paypal-marketing.com</a>, the website used by the payment processor for the <a href="http://www.hackerschronicle.com/search/label/PayPal">PayPal</a> Partner Program.<br />
<br />
Behrouz Sadeghipour has found and reported a <a href="http://www.hackerschronicle.com/search/label/XSS">cross-site scripting (XSS)</a> issue, a <a href="http://www.hackerschronicle.com/search/label/Remote%20Code%20Execution">remote code execution</a> flaw and an <a href="http://www.hackerschronicle.com/search/label/Information%20Disclosure">information disclosure vulnerability</a>.<br />
<br />
Initially, the researcher found the XSS flaw, which he reported to PayPal’s security team on March 19. The XSS was addressed on April 9.<br />
<br />
One day after the XSS was fixed, Sadeghipour identified an information disclosure issue, which he later leveraged for remote code execution. The expert said he was looking for an SQL Injection bug, but he found an RCE instead.<br />
<br />
To demonstrate the existence of the RCE to PayPal, he sent the company’s security team three links showing that he could retrieve the Process ID (PID), the script owner’s Group ID (GID) and the script owner’s User ID (UID) by replacing a parameter in the request with <a href="http://www.hackerschronicle.com/search/label/PHP">PHP</a> commands.<br />
<br />
By April 11, PayPal had addressed the vulnerability. The company has promised to reward the researcher in the next payment cycle.<br />
<br />
Sadeghipour highlights that the RCE he has found is a remote code execution, not a remote command execution bug. This vulnerability allows an attacker to run PHP functions. The flaw produces the same sort of results, but by leveraging PHP.<br />
<br />
Check out the proof-of-concept video for the PayPal Partner Program vulnerabilities. Additional technical details are available on <a href="http://nahamsec.com/2014/04/paypal-marketing-remote-code-execution/">Behrouz Sadeghipour's blog</a>.<br />
<iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/BB3rSd_muBc" width="560"></iframe><br />
Source: <a href="http://softpedia.com/">Softpedia</a></div>

RCE, Information Disclosure and XSS Flaws Found in PayPal

Hacking News Information Disclosure News PayPal Remote Code Execution Vulnerability XSS RCE, Information Disclosure and XSS Flaws Found in PayPal

A security expert has managed to identify three vulnerabilities on paypal-marketing.com , the website used by the payment processor for...

Hotspot Shield VPN is NO more Secure, Leaking Users Location

RCE, Information Disclosure and XSS Flaws Found in PayPal

Popular

Comments

Archive