MyspaceIM Info Disclosure: Silently Fixed

TippingPoint (my employer) provdes quite a few instant messenger filters as part of our IPS device, since some of our customers have fairly strict usage policies for their networks. These guys know that most IM networks are cleartext, get bounced off of third-party servers, can act as P2P file transfer clients, and basically open up all kinds of potential security problems.

So, the other day, I started taking a look at MyspaceIM, which is the newest major entrant in the IM space. And by "taking a look," I mean, "Googling," since my first step in nearly any task is to see if anyone else has already done my job for me.

Turns out, nobody's really looked at it, since most Google-able analysis start and end along the lines of, "It's port 1863, so it's like MSN Messenger." Of course, if you actually take a look at the traffic, you will notice immediately that it's pretty much completely unlike MSN Messenger, except for the port 1863 business. So I had to work after all. Rats!

The divergence from MSN starts with the initial handshake -- it's completely cleartext. No huge deal there, cryptophiliacs. After all, it's just MySpace, and who cares if there's no encryption. Most webmail these days is still cleartext (except Gmail, if you ask nicely). Not to mention the regular old MySpace web application, in which passwords are sent in the clear. So in itself, this is not all that exciting.

But there was one interesting effect of watching the traffic -- while I was messing around with the protocol, it turned out that the MyspaceIM servers returned different responses for "bad username" and "bad password," in a big, obvious way. This was something that the website doesn't do, and so it's interesting.

Combined with the fact that there was no throttling on how many login attempts are thrown at the MySpace servers (aside from normal Internet flakiness), I had myself a pretty effective (if silly) information disclosure attack.

At very nearly the same time, the AHA 0day Carnival was scheduled. So tickled was I with this discovery that I presented it there almost immediately after discovery. My slides, Myspace Account Enumeration, are available here. Of course, this meant that I had to report it to Myspace pretty much immediately, too.

By now, careful readers and grammar nazis will have noticed that I've been mixing my tenses in this narrative, sometimes using the past, and sometimes the present. There's a reason for that.

Turns out, if you report a vulnerability to MySpace, two things seem to happen: a) if it's easy, it gets fixed in under a week (as in this case), and b) they don't acknowledge receipt of the vuln, or tell you thanks, or anything. In other words, they fixed it, and now my slides are all wrong.

That's fine, of course, and ultimately the point of my reporting it. But part (b) hurt my feelings deeply, especially since I work pretty closely with people who make it their business to keep vulnerability researchers well-fed and well-loved. I guess I was naieve, and thought everyone was as considerate, careful, and caring as the fine people at ZDI.

Part (b), of course, is a pretty dangerous practice, at least according to the RFPolicy.

One footnote to this story: Yes, you can do pretty much the same thing by merely trying to "Add" all your e-mail addresses as your MySpace friend. But this is annoying because you have to be logged in, deal with cookies and all that other HTTP cruft, and do it slow enough to avoid getting noticed by the anti-spam controls (assuming there are any). Someone else can tackle that.