Conversation

Notices

1. silverpill (silverpill@mitra.social)'s status on Monday, 03-Jun-2024 08:56:06 JST silverpill

   Let's talk about object ownership in #ActivityPub

   I'm writing a new FEP: https://codeberg.org/silverpill/feps/src/branch/main/c7d3/fep-c7d3.md

   This topic is rarely discussed, but any server that doesn't implement ownership checks as described in this document is likely vulnerable to impersonation attacks.

   •  (mint@ryona.agency)'s status on Monday, 03-Jun-2024 09:03:01 JST 

     in reply to
     @silverpill So far it doesn't touch webfinger, which was the main cause of impersonation attacks lately, including the recent one against Pleroma performed by a certain bad actor.
   •  (mint@ryona.agency)'s status on Monday, 03-Jun-2024 09:03:52 JST 

     in reply to

     • 
     @silverpill Though "the concept of ownership, as applied to ActivityPub objects" implies that webfinger is out of scope. Still worth mentioning, I think.
   • silverpill (silverpill@mitra.social)'s status on Monday, 03-Jun-2024 09:16:41 JST silverpill

     in reply to

     • 

     @mint Yes, webfinger is out of scope, and as far as I know Pleroma was vulnerable because it didn't do proper validation during reverse webfinger lookups... Is that right?
     I don't know much about it. Mitra doesn't perform reverse webfinger lookups at all

      likes this.
   •  (mint@ryona.agency)'s status on Monday, 03-Jun-2024 09:20:01 JST 

     in reply to
     @silverpill I think so, after fetching an actor it performs webfinger lookup on the same domain, but due to faulty webfinger pipeline rewrite it accepted any arbitrary domain in response. I recall Mastodon had a similar vulnerability.
   •  (mint@ryona.agency)'s status on Monday, 03-Jun-2024 09:21:59 JST 

     in reply to

     • 
     @silverpill Though not only reverse webfiner was vulnerable, the regular one as well, if you search for @spoof@fakeinstance.tld, you'd get @victim@instance.tld as long as the fake instance returns the forged actor webfinger.
   • silverpill (silverpill@mitra.social)'s status on Monday, 03-Jun-2024 09:26:59 JST silverpill

     in reply to

     • 

     @mint I believe the correct procedure is described in https://swicg.github.io/activitypub-webfinger/#reverse-discovery

      likes this.
   • silverpill (silverpill@mitra.social)'s status on Tuesday, 04-Jun-2024 08:26:07 JST silverpill

     in reply to

     Finished the FEP and submitted it: https://codeberg.org/fediverse/fep/pulls/321