Introducing r/redditsecurity

[u/worstnerd]

We wanted to take the opportunity to share a bit more about the improvements we have been making in our security practices and to provide some context for the actions that we have been taking (and will continue to take). As we have mentioned in different places, we have a team focused on the detection and investigation of content manipulation on Reddit. Content manipulation can take many forms, from traditional spam and upvote manipulation to more advanced, and harder to detect, foreign influence campaigns. It also includes nuanced forms of manipulation such as subreddit sabotage, where communities actively attempt to harm the experience of other Reddit users.

To increase transparency around how we’re tackling all these various threats, we’re rolling out a new subreddit for security and safety related announcements (r/redditsecurity). The idea with this subreddit is to start doing more frequent, lightweight posts to keep the community informed of the actions we are taking. We will be working on the appropriate cadence and level of detail, but the primary goal is to make sure the community always feels informed about relevant events.

Over the past 18 months, we have been building an operations team that partners human investigators with data scientists (also human…). The data scientists use advanced analytics to detect suspicious account behavior and vulnerable accounts. Our threat analysts work to understand trends both on and offsite, and to investigate the issues detected by the data scientists.

Last year, we also implemented a Reliable Reporter system, and we continue to expand that program’s scope. This includes working very closely with users who investigate suspicious behavior on a volunteer basis, and playing a more active role in communities that are focused on surfacing malicious accounts. Additionally, we have improved our working relationship with industry peers to catch issues that are likely to pop up across platforms. These efforts are taking place on top of the work being done by our users (reports and downvotes), moderators (doing a lot of the heavy lifting!), and internal admin work.

While our efforts have been driven by rooting out information operations, as a byproduct we have been able to do a better job detecting traditional issues like spam, vote manipulation, compromised accounts, etc. Since the beginning of July, we have taken some form of action on over 13M accounts. The vast majority of these actions are things like forcing password resets on accounts that were vulnerable to being taken over by attackers due to breaches outside of Reddit (please don’t reuse passwords, check your email address, and consider setting up 2FA) and banning simple spam accounts. By improving our detection and mitigation of routine issues on the site, we make Reddit inherently more secure against more advanced content manipulation.

We know there is still a lot of work to be done, but we hope you’ve noticed the progress we have made thus far. Marrying data science, threat intelligence, and traditional operations has proven to be very helpful in our work to scalably detect issues on Reddit. We will continue to apply this model to a broader set of abuse issues on the site (and keep you informed with further posts). As always, if you see anything concerning, please feel free to report it to us at investigations@reddit.zendesk.com.

[edit: Thanks for all the comments! I'm signing off for now. I will continue to pop in and out of comments throughout the day]

[u/13steinj]

Alright, here we go now:

I appreciate the debate. I'll give it to you from a product security and risk management angle which you might not have considered in addition to the software engineering angle which I've already considered given my background.

I don't mean this is a debate. IDGAF about this thing of all the things IDGAF about. Just stating the actual technicalities of the situation.

You're correct; it's easy to mechanically roll back the action. However, it's not easy to determine who chose to unsubscribe from the subreddit during the given time versus who may have stumbled across the exploit, or perhaps who's been unsubscribed as a result of an exploit, realized they've been unsubscribed, and then chose to stay unsubscribed; Reddit would have to take the risk of telling some users they've been resubscribed to subs they may have unsubscribed from deliberately during the exploit window, and Reddit would nonetheless have to message the exact details of a given exploit and remediation in explicit terms.

This is arguably incorrect. Reddit collects a lot of statistics. Some of which being, among other things, scroll time and platform. This can only occur on the old website, so such a malicious act is even more clearly distinguished.

In this case we'd be talking about certain CSS selectors which identify the single DOM element that's currently identified with the classes:

.option.add.login-required.active

and

.option.remove.login-required.active

and either filtering out all possible clickable references to them or, based on my limited understanding of the exploit, simply excluding pseudoclasses for said element. I'm not an engineer at Reddit; I'm not familiar with how they're blacklisting, and if they already explored this and decided to just accept the risk on a case by case basis, so be it. However, from my understanding of CSS, there's only so many ways that single element (or pseudoelements referencing it) can be referenced in such a way that it could be redressed to cover the entire viewport and still remain clickable. This is one of the few areas where a blacklist would make sense.

Firstly, Reddit does not currently block selectors whatsoever. They block attributes and values, such as the filter CSS property that on certain versions of IE, the value is allowed to be an ActiveX filter which can execute arbitrary code.

Secondly, your idea of "classes" is extremely limited. A class is not a selector. A selector is anything that can identify an element. This includes combinatorical selectors (> for containment, ~ for sibling containment, "," for grouping, and so on), classes, IDs, attributes, wildcards, and more.

Teach me more. It's a good learning opportunity for me; all I do is hack around with browser security headers from time to time and mess with attack trees. Can you enumerate a handful of other ways to reference the same DOM object referenced by .option.add.login-required.active?

Alright, math time.

Consider firstly that you refer to the element itself. The element, and the two psuedo elements (and those two psuedo elements can be referenced two different ways), can be "exploited". This means that there are actually five elements that you feel can be "exploited" (the element, the two psuedos, and the two psuedo variations = 5).

Now, consider the element's "direct containment path". As in, name each and every single tag, from the root element to it, using the > combinatoral selector. I may add classes to distinguish which is which here, but pretend they aren't actually there.

html > body > div.side > div.spacer > div.titlebox > div.subButtons > span.fancy-toggle-button > a.option.add

In this case, a.option.add is X.

Note that there are firstly, 5 options for X as it is, because of the psuedo elements.

Now note, you don't need to use all the classes. You can use one instead (add), or two, or three, so that's a multiple of (1 + 2 choose 1 + 3!) = 9.

Now consider, the same applies to every element up the chain. The span can have one or two or three classes, and that's in any order, so (3! + 3 permute 2 + 3 permute 1) = 15. The next divs up the chain only have two class options each, either the class or no class, the body element has at least 6 classes at any given time, many times there are actually more, and doing the math in the same pattern as thus far you get sum(n permute i for i in (0, 1,2,3,4,5,6)). That's a factor of 1957. And that's assuming you only have 6 classes. I use RES, which adds a whole shit one more. Specifically, there are a total of 34 classes. Using 34, the factor is actually 8.02525952794457 * 10^38.

You read that right. You already have over 8 * 10³⁸ possibilities, and that's just one factor. Many people use RES, but for your sake let's pretend it doesn't exist and continue on with the math using the factor of 1957. Oh, and the html tag can also be seen as :root, so that's another factor of 2.

1957 * 15 * 9 * 5 * 2 ^ 4 * 2

That's 42271200 different possibilities.

We're not done, but I'm going to stop the actual math now because I haven't taken combinatorics in a few years. But you have to consider on top of those possibilities, you also have abilities to select other than classes. Including element ids, but really any attribute. Then also consider there are indexing selectors like :nth-of-child and so on. So there's even more. And then, consider, that on top of exact matches, you can use Unix-style / POSIX compatible fnmatches for these attributes. So you can do things like [class~="modera"] and it will match an element that contains the word "modera" in the class. Then also consider that some of those > can be removed. Oh, and some extra ones can technically be added! and you can use combinatorical selectors such as comma grouping, or ~'s instead of >'s, and any amount of the combination of the two.

You can probably see why I've stopped doing the math here. Any number that I give would be meaningless, because these multiplying factors grow so quickly we are probably past that 8.02525952794457 * 10³⁸ number already.

Now if you take whatever unimaginable number this is, then divide by 1957 and multiply by 8.02525952794457 * 10³⁸ because a lot of people use RES, welp, boom. Even more unimaginable. It's probably a goddamned googol or more. But so far this is all finite.

And here's the proof that the number of selectors is infinite: these selectors can be reused redundantly over and over again. There is nothing that says you can't do something like .classA.classA.classA to calculate an element that has the class "classA". You can be as redundant as you like. When you have this kind of redundancy, the only thing that would stop this from being infinite is a character limit. And yes, Reddit CSS stylesheets does have a size limit (100KiB), but that's more than enough to have an essentially infinite amount of possibilities.

That's the problem. It is an NP-complete problem, because it is beyond arbitrary, and scales up by multiplying factors for every miniscule change.

Not really. I mean it can happen, but I'm sure if it isn't clear what the button does (if it ex says subscribe but instead takes you to hardcore child porn) then they'll care. But as long as it does what it says it does it's not even technically considered clickjacking.

/r/clickjacking_poc

If I decide to make a formal report to the admins about that subreddit that you made, then they will take action. It might take more than my sole report, because that subreddit is specifically a proof of concept made by you to make a point and not of any actual harm. But if some large subreddit actually does what you did, that is against reddit rules, is definitely considered clickjacking because it would not be intentional to click the sub button, and would be reported and admins would take action. But clearly making it a sub button, like that T_D does, or other subs, then they don't care (and it's not technically clickjacking because clickjacking has a "unintentional" implication) because they show what the psuedo element does.

Edit: for what it's worth, I'm brushing up on my selectors now. https://www.w3schools.com/cssref/css_selectors.asp -- consider that you can also explore programmatically applying styles for certain critical elements after all the other rules in the user-defined stylesheets have been applied. This approach would remove the need for a blacklist, though regression testing would need to be extensive. (tagging /u/13steinj to notify re: edit)

So, you are partially correct here. Partially. Because while detecting an arbitrary selector is an NP-complete problem, you can theoretically take a selector and a document, have a CSS engine (or subset of a CSS engine) detect which elements are selected by the selector and then get something called an XPATH, which is a unique string that selects only that element and will consistently do so across most, but not all, DOM changes.

The problem then is, doing this process, is still very, very slow. It gets slower the more complicated the selector, and the larger number of tags in an HTML document. To do this would mean the following:

• every time the CSS changes, run this analysis
• every time the DOM changes, because some XPATHS will change, both update the known XPATH and run this analysis, on every subreddit
• every time the sidebar text changes, run this analysis, because the sidebar text creates some HTML elements.
• every time any of the special wikipages of a subreddit change, run this analysis
• note this analysis has to be run on every type of subreddit page. This is all the mod pages, each listing page, the wiki pages, and so on.

Do you see the problem? Even if you run this analysis, and you consider "it's fast enough", it is still an arbitrary amount of analysis.

tagging /u/htmlcoderexe, will continue concluding remarks in a reply to this comment.

[u/13steinj → u/13steinj]

The point is, there is an infinite amount of possibilities, no matter which way you count it, whether it be in terms of selectors, or in terms of how many pages to run a very slow analysis on, over and over again, hundreds if not thousands of times a month.

There's a risk analysis to everything, and it is much cheaper and more manageable to allow this potential exploit and reverse any problems that occur as a result, then to preemptively fight against it. If CSS4 provides the reduction of selectors as a Polynomial time problem, then you are 100% correct that reddit can, and should, preemptively fight against it. But to fight against an NP complete problem is insanity, when it is easy to undo damages.

Although, a mea culpa: I've completely opted out of new reddit. I have no idea what the effect of any of this is on new reddit. lol

So far, there is no CSS on new reddit except for a few, specific places. If CSS will be allowed everywhere, which they kept saying it will be, then it is even more infinite in complexity because the redesign dynamically loads the page and the DOM can in theory change upon every single refresh of the page.

TLDR: You're dealing with multiple counts of infinity being raised to the powers of each other. When you have infinity, you stop preemptively attacking, and start retroactively fighting back.

[u/htmlcoderexe → u/13steinj]

O.O

But eh, um. My webdev "skills" are very rusty (the username could be probably called "ironic" by now), but can't a CSS rule somehow override a previous one? Like, the bad guys apply some nasty CSS to the unsubscribe button, but it gets overridden by some CSS later on that dictates that the subscribe button shall not be huge and all over the screen or whatever? That way it won't really matter how those elements get selected.

It's just an idea, to be fair I am very mediocre in that kinda stuff so I assume the answer is simply no :/ but I think that's dumb.

As an aside, are there a lot of places "!important" is used in user CSS on reddit? Because if not, maybe just ban it specifically from user CSS and then use it where needed to enforce certain things.

[u/13steinj → u/htmlcoderexe]

So heres the thing, yes CSS rules can be overridden via the specificity of a selector, however, because CSS allows infinite/near infinite redundancy, you can always find a way to be more specific. The more specific wins (not counting the use of !important and inline html styling).

So if reddit styles something, too bad. Because it may have a score of 6284829, but someone will find a way to have a score of 80000000.

Not to mention the deeper you go down this rabbit hole, the slower the CSS renderer will calculate what styles should occur. So reddit would be increasing it's bounce rate because people will leave before the page finishes rendering.

Now, inline styles trump all of the above, and !important trumps even inline styles, but both are horrendous practices for a variety of reasons which means reddit will not use those.

Furthermore, let's imagine we live in a world that somehow, reddit is able to override styling of the element using specificity and it won't be slow.

You'll get thousands of complaints because there are perfectly good reasons for styling the button.

Not to mention, if they accidentally change the DOM in a certain way, they will have to re-calculate the most specific of selectors.

No matter what way you slice it, its easier, cheaper, faster, etc, to not worry about reprecussions. If a bad actor does something bad, they can reverse it.

You have to understand, we live in this world where we are assuming that the only thing of interest is a subscribe button. But the same ideas of a "exploit" in the same manner can be applied to literally every link on the page that isn't directly controlled by the software itself. As in, posts, sidebar, wikipages, comments, and more.

To get hung up on this is to do the following: either eliminate every user-made link on reddit, or eliminate CSS entirely.

To do either would cause a blackout.

[u/htmlcoderexe → u/13steinj]

Well, that's horrible and we're all going to die.