Saturday, December 07, 2013

Security breach at Myntra.com exposes customer's personal information, order history and more

Update (added on 3 Dec 2013): Based on my feedback Myntra.com has now setup security@myntra.com for reporting security issues and a Responsible Disclosure Policy page. Kudos to them for taking the first step towards a better responsible disclosure process and setting an example for other Indian companies.

Last week a bug on Myntra.com let anyone with an account take over random customer accounts and highlighted the lack of responsible disclosure processes among Indian companies.

On 28th November (2013), Myntra.com held a 3-hour (8-11pm) invite only Winter Sale event where a few select customers got an additional 31% off on all orders above a certain amount.

I was one of those customers and decide to login to my Myntra account to see the coupon, except I had forgotten my Myntra account password. So I went ahead and put in my email address and clicked on the forgot password link. As expected I got an email with instructions, to click on a link to set a new password. What happened next was very scary.




I clicked on the link and landed on the page on Myntra.com to set a new password but instead of my email address I saw someone else's email address pre-filled in the form. Curious to see what would happen, I went ahead and put in a new password and lo and behold, Myntra.com had let me take over another customer's account. 




To see if this was repeatable, I went through the forgot password flow again and just like before it had another random customer's email address pre-filled in the form and let me take over that customer's account.




HOLY SHIT. Myntra.com just let me take over two customer accounts. No fancy hacks, just a scary little bug that presented other Myntra customer accounts to me on a platter.

So the first thing I did was see if I could find anything on Myntra.com about responsible disclosure or a security contact but found nothing. So I sent an email to security@myntra.com and it promptly bounced with the message "The email account that you tried to reach is over quota".

Next I got in touch with them on Twitter and 13 hours later someone got in touch with me, 16 hours later I was speaking to a Tech Lead from Myntra.com and 9 days later I have confirmation from them that they have fixed the bug and put measures into place to ensure this doesn't happen again.

Note (added on 8 Dec 2013): The bug was fixed on the same day I reported it and the 9 days mentioned above includes time they took to monitor the fix and the Tech Lead at Myntra.com and me having issues around coordinating the final confirmation phone call.

I don't know how long this bug was live and how many customers accounts were affected but if your account was one of the affected ones, it means someone had COMPLETE access to your account, your personal details like your address and phone number, your order history, your myntra credit points, your saved payment details, your wishlist and your shopping cart.

Apart from the privacy concerns, the biggest threat that you need to protect yourself from, with a security breach like this is that it opens you up to Social Engineering Attacks where anyone with this privileged information can pretend to be from Myntra.com and use it for malicious purposes.

While a lot of people reading this will focus on Myntra, I think it's important to focus on what this incident can teach us about the lack of Responsible Disclosure processes among Indian companies.

If you run an online service (and especially an ecommerce one) you MUST have a responsible disclosure process in place. The Open Web Application Security Project (OWASP) has a good primer on managing your security issue disclosure process. At a very basic level you should atleast have a security@ email address configured. Having a dedicated page for responsible disclosure on your website is an added bonus.

Here are some examples of good responsible disclosure pages to get you started:



Lastly, I think it's important for companies to be transparent and honest about security/data breaches. Hiding details about breaches from your customers makes them vulnerable to all kinds of attacks. Security/Data breaches happen all the time. The only way customers can protect themselves is by being informed.

Sunday, June 09, 2013

Really Simple Social Blogging

A proposal to implement a decentralized Tumblr/Facebook/Twitter like social blogging platform using simple things like WebMention and Microformats. This is based on some experiments I'm doing with Converspace on sandeep.io and was inspired by The First Federated #Indieweb Comment Thread.

Based on usage, it looks like I primarily do 4 things on sandeep.io:
  1. Post original content. This could be text (both short and long form), links, photos, videos, quotes, etc. (http://www.sandeep.io/19)
  2. Repost content from others I find interesting. (http://www.sandeep.io/36)
  3. Comment on content from others. (http://www.sandeep.io/32)
  4. Like content from others. (http://www.sandeep.io/33)

Turns out this is also broadly what you do on Tumblr, Twitter and Facebook:
  • Tumblr: blog, reblog, comment and like.
  • Twitter: tweet, retweet, reply and favorite.
  • Facebook: update status, share, comment and like.

So I set out to see how this could be done in a decentralized way across the #indieweb. A couple of experiments later, I think I have a simple solution for achieving this, using nothing more than simple things like WebMention and Microformats.

The "social" part of this is letting others know that you have done one of those 4 things listed above and especially the person whose content you've reposted, liked or commented on.

This is where WebMention comes. It's a simple way to let any URL on the web know that  you've linked to it on your site. The problem however is communicating the context in which the URL was mentioned:
  • Was it just mentioned in passing along with other content?
  • Was it's content reposted?
  • Was it liked?
  • Was it linked to by someone commenting on it?

Taking a cue from the the experimental u-in-reply-to microformat, I'm using the following experimental classnames for links within h-entry:

A target URL that receives a WebMention can retrieve the source URLs HTML content and look for the above Microformat classnames to figure out the context in which it was mentioned along with an h-card/p-author entry to figure out the person involved.

The target can then show:
  • Total number of likes along with the details of the people that liked it.
  • Total number of reposts along with the details of the people that reposted it.
  • Total number of mentions along with the URLs of the sites that mentioned it.
  • Comments along with the details of the people that commented on it.
See this in action here: Indieweb Federated "Likes".

An important part that is missing from the above is letting other people easily follow you and get updates when you post something on your site. A microformats based feed reader should solve that. Following someone also gives you the opportunity to send a WebMention to the profile URL of the person you followed which in turn allows that person to show a Follower count (using u-follow maybe) along with the details of the followers. I've yet to explore this but will be posting more details when I get to it and dogfood it.


Wishlist: A microformats search engine that crawls the web looking for microformats, especially h-card so I can search for people just like I can on silo social networks.

Here are some additional experimental classnames I'm considering but not yet using:
  • u-quote to be used when you quote text from a URL verbatim.
  • u-follow to be used when you follow/subscribe to a URL (usually a person)


Todo

  • A way to undo WebMentions (e.g., unlike) by deleting the source URL and sending a WebMention for which the target would receive a 404 in turn deleting the original WebMention. 
  • I'm also hoping to extend WebMention to allow for private access to URLs to only the people that were sent a WebMention.

Updates

08 June, 2013
  • Added h-card search wishlist.
09 June, 2013
  • Added attribution to the @eschnou's indieweb comment thread that was the first instance I know of that combined something like WebMention (Pingback) and Microformats to figure out context. It went beyond the simple rel="in-reply-to" suggestion made in WebMention and read h-cards.
  • Added note about sending WebMentions to user profile URLs. (rememberd to add this thanks to this tweet by @benwerd)
  • Added note about private access. (rememberd to add this thanks to this tweet by @benwerd)
  • Added list of other experimental classnames I'm considering.
10 June 2013
  • Created the Todo section and added note about undoing WebMentions.

See Also

Friday, June 07, 2013

Extracting machine tags (aka triple tags) from a string

Here's some working code to extract machine tags (aka triple tags) from a string. Possibly one of the ugliest regular expressions I've ever written.

References