4

Suppose we have website that use MD5 hash in URL like this:

http://somewebsite.com/XXX/

where XXX is MD5 hash.

Content of this website may have sensitive information like transaction details with personal data.

There is no other authorization to this website, so if you have URL you can access it.

How safe is it? I mean, if no one will share URL with anyone, then can I assume no one will access it?

How much time could it take web crawler, to crawl through all combinations of such url?

I ask because I am using some web shop, that store transaction details with personal data in such manner, I am saying them that it's not secure and someone can view their clients sensitive data, but they are not convinced. To build web crawler it's simple to me, I know how to do this, but I don't know how much time it will crawl through all combinations, maybe at shop they are right? This is not about my website, I am end user of that shop, and I need to convince them they are wrong.

|improve this question
  • 1
    An md5 hash of what exactly? Also what kind of data is being exposed, any payment information, or just an invoice? – lzam Sep 17 '14 at 22:04
  • Exposed are exactly payment information with bank account number together with invoice data. MD5 is in url, sensitive information are in website content, not in hash. I don't want to decode hash, I need to know is it possible to crawl through all such sub pages and approximately how much time it could take. – BlueMark Sep 17 '14 at 22:16
  • 1
    I am asking what data is used to generate the MD5 hash contained in the URL, in order to determine how predictable the "secret" URLs are. – lzam Sep 17 '14 at 22:19
  • 2
    Regardless of how guessable the URLs may be, if the data availabe from these links includes payment information, it could be a violation of your country's laws and/or important industry standards such as PCI-DSS, and could result in very serious legal/financial penalties. – lzam Sep 17 '14 at 22:24
  • 2
    You don't need to crawl through ALL combinations - you just need to find ONE that you are not authorized to access. That proves the method is broken. Because it is an MD5 hash, it is also likely the same length each time, which makes it easier to narrow in on a valid link. – schroeder♦ Sep 17 '14 at 22:56
6

There are a couple of issues to consider with "secret" URLs.

First, they offer a different level of security against discovery when served over HTTP vs. HTTPS. Over HTTPS, the path is protected. Over HTTP, it is not. This means that when using HTTP, anyone in the path of the traffic (people sniffing wireless traffic, proxy servers, caching servers) have access to the path and can therefore discover it. Over HTTPS, only the hostname is exposed, the path is protected from eavesdroppers.

Second, they can be bookmarked or saved in any number of ways. You have to consider whether the misuse of bookmarked URLs is a significant threat to your application.

Third, there's no way to expire access to a valid URL. If you have an authentication system, you can enforce session timeouts of some form. If you don't, as long as the URL is valid, anybody who has it can access it.

Fourth, and more specific to this specific application, is Izam's question in the comments. What is being hashed to create the URLs? If it's something like an incrementing integer-based transaction id, or something other source for which an algorithm can easily generate candidate inputs and hash, no, it would certainly not be safe because an attacker could generate a set of potentially valid hashes and try them all. They may not all work, but if some of them do, the scheme is broken. Particularly if it is something like an incrementing integer, because if they discover valid inputs, all valid URLs can be easily determined and exposed.

So, secret URLs can be a valid tool in some cases. With personal information at stake, particularly financial information, I would not rely on this mechanism. It's far too weak.

|improve this answer
  • Does the answer change much depending on the hashing algorithm? I doubt it, but I wanted to ask. – mrwaim Jul 14 '15 at 23:37
  • @mrwaim the length of the hash is probably more important than the hash algorithm directly. Because you don't need to find the original data to gain access, the hashing doesn't make it any more or less effective than random digits (both bad ideas). – Anonymous Penguin Jul 5 '16 at 3:07
0

You don't need to crawl through ALL combinations - you just need to find ONE that you are not authorized to access. That proves the method is broken. Because it is an MD5 hash, it is also likely the same length each time, which makes it easier to narrow in on a valid link.

I believe that a crawler would take less than about 5 lines of code, and less than an hour to find a link that you should not have access to.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.