Untitled

NOTE: The following contains instructions that may violate the mintshot TOS, anything you do is your own fault.

This is being posted so that the public can see how badly written mintshot is, which will hopefully kick the developers into fixing it so that those people who enjoy watching ads can get paid for it (I’m not one of them).

 

Mintshot is a poorly coded, insecure and easy to cheat website.

The level of security shown on the site makes me worry for the future of web development.

The security problems detailed in this post, allow users to gain more m$ (the currency on the website) than they should be able to, thereby giving them an unfair advantage over the people who use the site legitimately.

 

Layman’s version: People can cheat on mintshot and get more money than you. This will let them win every auction and get all the prizes!

 

Background

 

You can skip this section if you know what mintshot is.

 

Recently Mark Ellis launched the site mintshot.co.nz

The site allows users to watch ads in exchange for “mintshot$” (m$), these m$ can then be used to bid on auctions for prizes.

 

The ads are worth varying amounts of m$:

 

    * Platinum: 200

    * Gold: 100

    * Silver: 50

 

There are a limited amount of ads on the site for viewing at a time, these are refreshed every ~9 days to allow people to get more m$.

 

There are other ways to increase your m$:

 

    * Invite friends to Mintshot (Processed daily)

    * Link to Mintshot (Processed manually?)

    * Recommend brands / “Play the People” questions (Processed manually?)

    * Play the people (Game) (Processed daily?)

    * Cheat the ads (More on this later :P )

 

“Play the People” (PTP) is a public opinion poll game where you choose a percentage of agree/disagree between 2 opinions, example: “Is breastfeeding babies in public OK? Yes / No” and “bet” how much you think you are right. Then if you get it right (Based on the average of the given opinions?) you are rewarded with some multiple of how much you spent. Some people who have won at PTP.

(I haven’t messed with PTP so I don’t have a further breakdown. I would not be surprised if there is no bounds checking on the value you can bet, but as it is not active at the moment I cannot test).

There is a bit of a description on how scoring in PTP works over here on nzrealitytv.com

The story so far / Notes

 

There was previously a “Mint tick Auction game” where instead of bidding money you would play a game that seemed to be completely controlled by random chance. If you got a higher score than the current leader you would become the new leader and so on. It didn’t take long for people to start abusing this: NZ Herald Link.

I’m not sure how this was done as I didn’t play with it. If you know then drop me an email and I’ll add it here.

 

I’m not the only one out there who has poked at the security of mintshot.

 

mintshot is built on joomla. [Originally the “Unable to connect to DB” page was unskinned]

This means that it is PHP based with a MYSQL backend.

 

It would appear mintshot was created by a team in India. (Source). Hows that outsourcing working for you Mark? Looks like you get what you pay for.

There is bad grammar throughout the site and the html comments. (Not that I’m saying mine is perfect, but theirs should be alot better than it is!)

 

There is a bunch of unused javascript and code comments across the site that the public shouldn’t be able to see.

Example:

/* function onPlay(clip){ alert("hellllo"); } */

Seriously, guys… get rid of the debug code before pushing something live!

It would appear that at one stage users were going to be given discount vouchers for watching ads. (Javascript code still exists to do this)

 

Shouts out to gopi and Teju who’s names appear in the code. :-)

Flaws (The juicy stuff)

 

You are going to need html/forms knowledge to fully understand this section. Javascript knowledge would be good too!

 

The mintshot site is very public with its form values, what does this mean to you?

Well first, this is the process of watching an ad (General case, there are variations of this):

 

   1. User opens the page to view the ad

   2. User clicks play on the video

   3. When the video finishes playing, the flash applet makes the answer box visible and positions it in place of the video

   4. The user chooses an answer (Usually from a <select> list) and submits the form

   5. If the user gets it right they are awarded m$, if not they can just choose a new answer and try again without watching the video again

 

Infinite Money

 

Now, lets see if we can save some time. Personally I don’t feel like actually watching the ads, so lets see if we can skip that. This is easily done as the HTML for the form is always there, it is just hidden.

Bookmarklet to acheive this: (Create a bookmark with this as the url and click it):

javascript:void(document.getElementById('questdiv').style.display='');

Security hole: There is no enforcement of watching the ad. Would the advertisers like this? I don’t think they would!

Potential fix: Don’t put the question html into the page until after the video has been watched, or make the question part of the flash. Reverse engineering flash is slightly more difficult than playing with html. (I’m actually a bit clueless on this one, this is sort of a fundamental flaw in the website which is difficult to fix)

 

Great, that’s a good start, saves me watching those damn ads!

But now I don’t know the answer…. well I could just guess, but lets see if we can be smarter.

If you jump into the code for the page and look at the <input> fields, you’ll find one called “correctanswer1&#8243;, and it contains… the correct answer!

Well, we may as well alert ourself the correct answer…. (you could be smarter here and fill in the answer, I’ll leave that up to the reader)

javascript:alert(document.getElementById('correctanswer1').value);

Security hole: The user is told the correct answer and as such does not need the knowledge that watching the ad provides.

Why the hell does the user get told this in the first place? Seriously this is shoddy coding at its finest.

Fix: Don’t tell the user the correct answer, they don’t need to know it!

 

Bonus points: when you submit this form, the value of correctanswer1 is compared to the answer you give, so if you change its value you can have lots of fun!

 

“What ailment can not be underestimated?”

Correct answer: “Stupidity”

Awesome :-)

 

Great, if we put these together with a bit of smarts, we can come up with a bookmarklet that skips the video, fills in the answer and submits the form all in a single button click…. You can do the leg work on that one :P

 

This only gives us as much money as everyone else who legitimately watches all the ads however, that’s no good!

Hhhmmm… Lets take another look at those form values.

Oh look at that, there is one that specifies the value of the question you are answering:

<input id="type" type="text" value="platinum" name="type"/>

mintshot has been overly trusting of my form values so far, will it stop here?….. of course not!

When submitting any question, you get to specify its value, change this to your choice of “platinum”, “gold” or “silver” to get 200, 100 or 50 m$ respectively.

Security hole: mintshot allows the user to change the value of an ad.

This should never of been an input value… this is another example of shoddy coding.

Fix: Get rid of this form value, it is obvious what the m$ value of watching the ad is based on its id in the database. If you are scared of the tiny extra database load this will cause, then investigate memcached or something similar.

 

Awesome, now I can get more money than everyone else can by watching ads. But this still isn’t infinite money, we’re going to have to go a step further for that!

 

Jump back into those form values, there are a few suspicious ones…

itemid - seems to be the id that corresponds to the provider of the ad you are watching. Changing it changes what shows up in your “My Earnings” list. Invalid ones work but leave a blank entry in the list.

userid - seems to be the userid of the company this ad is for, haven’t played with it.

quesid1 - A unique value that seems to correspond to the question you are answering (Question != ad). Submitting different ones allows you to answer more questions than exist, letting you get lots of m$.

 

Security Hole: There is no (or very very minimal) contraints checking in the mintshot backend, you can answer questions that don’t exist for companies that don’t exist and mintshot will gladly award you m$ for it!

Fix: Put in some constraints checking. Foreign Keys are your friends, and if you are using mysql with MyISAM tables (instead of InnoDB) then you will have to code checks for this, which you should be doing anyway!

 

Alright, so changing the quesid1 will allow us to get as much m$ as we want, so how do we automate this?

Well, you could make a bookmarklet to change it and manually submit a bunch of forms.

Or you could do a packet capture when you answer a question then write an application to automatically re-submit the form with a different quesid1 each time, giving you as much m$ as you want! (This is the path I took, it worked well)

That is enough details on this, I’m not going to share my code to do it as this is a technical overview and not a “HOW TO CHEAT MINTSHOT” guide.

Bidding as someone else

 

This would appear to be fixed now, but I’ll detail it a bit anyway :-)

 

Open up an auction and check out the hidden <input> fields again.

There are a couple of interesting ones:

currentbidder - userid for the current auction leader

currentuser - (This is in there twice wtf!?) - userid for the currently logged in user

 

Previously if you changed the value of the currentuser fields you could place a bid for someone else.

This doesn’t mean this page is secure now, far from it.

Security Hole: The user knows the userid of themself and the bid leader, which they do not need to know. These are used in the javascript to warn the user if they try to outbid themself.

Fix: Have a single form (or javascript) variable specifying whether the user is currently leading bidding.

Proof

 

I put this to practice and won 2 auctions (on the same account) for incredibly ridiculous amounts of m$ (around 20x more than you could legitimately get)

Auction 1

Auction 2

 

But… both of them arrived in my mailbox: Vouchers Pic

Obviously no one at mintshot bothered to check any of the prize winners, even some anonymous blog poster managed to spot these bids. My username was “degar”, but you were close ;-)

 

I then pushed my m$ up to 4,000,000 by “answering” the same ad 20,000 times. Certainly that should of raised some red lights!

(I didn’t spend this and it was removed in the December reset)

Image proof, gmail messed the email up a bit.

What can we learn from this

 

    * Always try break into your own site.

    * Hire competent people.

    * Keep watch of your database for strange occurrences.

 

Question for the mintshot guys (Who I certainly hope read this!)

 

Can I redeem those vouchers for prizes or do you want em back?

I could do with some new clothes and as you can tell from the terrible picture I took of the vouchers, a camera would go down well too :-)

Contact details:

 

danzel@localhost.geek.nz