Quip-Text exploits revealed, server shut down

[hckrwolf]

So I'm not sure if anyone else heard about this, I tried searching anything on Quip-Text and couldn't find a single thread on here...so here's the story, for anyone who's unaware or is wondering why Quip-Text isn't working right now.

The background info.
Quip-Text is an app for the iPhone that allows people to send pictures to others without paying for MMS. QT does this by uploading the picture onto their server, and generating a random URL for the user to send (via SMS) to another.

The first mention of an exploit.
On November 5, 2009 someone on digg was looking at how QT worked and realized two things:

1. QT generates the URLs using only 5 random letters or digits (following the URL base). This supposedly means that there are 60,466,176 combinations QT could use.
2. QT does not have any encryption on these URLs, meaning anyone who has the link can view it without any sort of authorization.
​

The user then created a script that generated random URLs and showed the picture embedded in each one. The exploit didn't seem to gain any attention, and was left alone for months.

The exploit is spread throughout the internet.
On March 28, 2009 Anonymous dug up the exploit, and threads began to show up on several imageboards (specifically, 4chan) where users were given the script (which now had it's own webpage) and could browse through thousands of pictures to post their favorites in the threads.
It was at this point that Anonymous realized QT also supplied the sender's contact info with every picture sent. This caused chaos on social networking sites like Facebook as users posted NSFW images on the senders' walls or shared them with the senders' friends, family, school, etc.

Eventually, this caused a DoS on QT's servers, shutting them down temporarily. QT investigated the cause, and realized thousands of pictures had been leaked onto the internet. The creater of QT had this to say:

Hello, this is Ish, the founder of Addy Mobile, makers of the Quip app.
As soon as this post came to our attention, we immediately shut down our servers. We have also now disabled all S3 access and have started to systematically secure all files in the system. We will not bring the system back up until we have adequate security around all files shared over Quip. I apologize to our users for this security breach and promise we will do everything in our power to make sure none of their information is exposed once we bring the service back up. The vision for Quip has always been to provide users a quick, simple, and affordable way for iPhone users to send picture messages without paying exorbitant carrier fees. We are a small company (3 people) but we will work as quickly as possible to bring back the service up in a safe and secure manner.

Which a user on Reddit replied,

A breach in security? A breach would imply that there was some flaw in your security. What you had was a complete lack of security. Putting the photos on a hosted server? I refuse to believe anyone is that incompetent. You were just lazy with people's private data, and got called out on it.

The aftermath.
As stated by Ish, QT was shut down completely - this means users cannot upload new pictures or view pictures previously uploaded.
Ish claims to have the site up-and-running ASAP, but considering his team consists of only 3 people, I'd say they're offline indefinitely. They'll have to clean out their servers, deleting all of the pictures and text, clear the URLs, and write out a new code with actual encryption on it.

A humorous post on 4chan said,

Saturday: No one knows about your company.
Sunday: Anon Finds your company and everyone knows about your company.
Monday: You have no company.

Anonymous then affectionately declared it Quiptxt Day, stating:

The EPICNESS that is Quiptext Day is the result of Anonymous realizing that the protocol for sending these pics was secured by only a five digit alphanumeric code; randomize this code using some simple PHP programing, and the millions of pics that these massive retards had sent came spilling out, swamping *** with the biggest tsunami of chemo-OC ever.

What Anonymous was trying to say is that the exploit on QT links was phenomenal because it gave Anonymous TONS of "original content", which revived the imageboards with pictures other than the ones Anonymous has seen over 9,000 times.

Anonymous has also created an (NSFW) Encyclopedia Dramatica for Quiptxt Day, where some of the content has been saved.
​

Well, there's the whole story for you. I decided to type it all up and post it somewhere so more people would be aware and would think "maybe it's not such a great idea to have my nudes hosted on the interwebs where everyone can see them, track them down and show them to my family."
I hope you guys liked my post, and if you used QT, watch out next time!

Also, this is my first post and I wasn't exactly sure where to put this thread...apologies ahead of time if this is wrong.
Cheers!

 

[Mikeluv]

Thx for sharing this news.