I am more than sure that none of the owners of the sites involved condoned or suggested hacking the results. But they must have had fans with skills …

And also read the comments on each site: Pharyngula; Climate Audit 1,2 and BadAstronomy!
Damn! These scientists are haters …

What's the Science Scandal all about?

It appears that the science category voting at the 2007 weblog awards was completely flawed and gamed by both sides. Just that one side was a bit stronger in firepower - so some say. And I decided to verify this!

Tools of the Trade!

I needed:

Their Flash movie that enabled people to vote
A Swf Decompiler!
C++

First thing had to get a copy of the Flash file handling the poll which we find here in the HTML code of the page:

I needed to find where this Flash loaded the results (a feed) and where it casts the vote (URL). Now I was after the feed where they kept the internal results of the poll. After analyzing the Flash Code I finally found it at the end of the code:

I also needed a poll ID but I already found it above in the HTML code. At this point we need to see where the voting actually goes. The server-side script that handles the voting.

First wrap!

We know have the PollID = 117 , the XML Feed Address = http:// 2007.weblogawards.org / get_poll.php?poll_id=117 , the Server-Side Voting Script = http:// 2007.weblogawards.org / poll_vote.php? poll_id=poll_id&vote=opt_id&ver=security_key.

Analyzing the results feed!

This snapshot was taken way after the votes finished and the status of the poll is still open. Look at the red marks. We also see here the ID of each entry in opt_id which we need in the link to the voting server-side script.

We know have everything except their only security measure. The security_key which is required in the URL to vote.

Breaking the security key!

I will show you how this is put together after analyzing the swf file. We find 2 references of the security key. And we notice it's a simple thing:

We have the opt_id sum + "_" + BIG_S. The BIG_S can be seen in the XML feed above - the red thing in right top corner. After we have the concatenation of the three terms above we do an MD5 hash on them and then we convert this to HEX (00-FF) as no binary data goes over POST requests.

We now have a poll_id, opt_id, sec_key and the voting URL is easy to do. Do keep in mind the BIG_S changes everytime you load the page. So, in order to vote, you have to load the feed and then cast the vote for every vote.

This was easy … actually too easy! Clock time: 5 minutes + 10 minutes for the algorithm to actually do the work, which now is pointless and I won't code it anymore. How do I know it works???? Easy! Look below.

While looking at the Flash file they provide you a security key check. So you know the following:

And as I had both algorithms written I checked against the feed and I can produce the right key using this:

Steps left:

The hacker needs some proxies and then can attack the voting sequence at his will on any poll on anyone. The more proxies he has the better. I have full respect for both Bad Astronomy and Climate Audit which both gamed the system, as many say, and this proves that Science blogs do know science and good al-gore-ithms!

Why did security failed?

The hacking could take place during entire voting time and about 4 hours after official closing. For some security tips read my other post - defending your Polls and Server-Side scripts.

21 Comments Posted By Readers :

Add your comment

#1 sod from Germany web