Post by @elena@aseachange.com

Dear Fedi friends,

Yesterday I posted a toot about #WSocial on this account (I typically talk about them on Mastodon, but I needed more than 500 characters, so I switched here). It was widely shared and discussed.

Some of you may have missed my articles critiquing W Social. I have been following them - with a critical eye - and collecting evidence since their soft launch at Davos in January: https://blog.elenarossini.com/tag/w-social/

Anyway, some of you mistook the tone of yesterday's toot and thought I was ENDORSING signing up for an account on W Social. In reality I was being sarcastic 🙃

I will make sure to spell out my intentions much more clearly next time.

At any rate, my latest article about them made it to Hacker News yesterday (wild) and my research has been quoted in Dutch, German and French news outlets. The tide is finally turning (from fawning PR coverage to a more distanced, critical look).

Thank you for your support as always! ❤️

#blog

Elena Rossini

W Social - Elena Rossini

Essays by Italian film director and photographer Elena Rossini - about creativity, digital literacy and harnessing the power of the internet for change

⁂

More from

Elena Rossini

#wsocial #blog

⠠⠵ avuko

@avuko@infosec.exchange · 2 days ago

@elena @aral I couldn't resist, so I've wasted my precious time looking at "W Identity" today.

Things are not right.

It is basically a repurposed https://github.com/PeterWaher/IoTGateway

Just look here: https://root.widentity.eu/Settings/Master.md

It has a socks4(?) open on port 1080, some xmpp stuff on 5222 and 5269, another (seemingly broken) version of the website on 8088.

The following pages are accessible without auth:

(found by a simple "egrep -LR 'Privilege:|Login:' * |grep md | grep Root" through the source)

/Settings/PersonalData/LocalDatabase.md
/Settings/PersonalData/LocalSensorsAndDevices.md
/Settings/PersonalData/EventLogs.md
/Settings/PersonalData/NetworkIdentity.md
/Settings/PersonalData/WebPages.md
/Settings/PersonalData/Backups.md
/Settings/Master.md
/Copyright.md
/Starting.md [http response 307]
/Login.md
/Entities.md
/Templates/Repeat.md
/AdminDropdownComponent.md
/Script.md
/AdminDropdown.md
/AlertPopup.md
/Master.md
/PromptPopup.md
/ConfirmPopup.md
/Markdown.md
/Emojis.md
/Smileys.md
/Index.md
/MarkdownEditor.md
/ScriptColors.md
/Master.md

Others pages also exist (no 404), but are only available after login.

Which brings me to the biggest problem of all.

This is an ADMIN interface.

Nobody should ever put an admin interface to an identity management platform on the internet.

#WSocial #Widentity

Neuron® Setup

Main menu during setup

GitHub

GitHub - PeterWaher/IoTGateway: New project

New project. Contribute to PeterWaher/IoTGateway development by creating an account on GitHub.

Emelia 👸🏻

@thisismissem@hachyderm.io · 2 days ago

@avuko @elena @aral yeah, this matches what we found when looking for a way to report the XSS directly to them: https://root.widentity.eu/Feedback.md

But it explicitly says not to send sensitive information despite being the security.txt only contact.

It was the root path on that domain and auth.widentity.eu that pointed me to TAG or Trust Anchor Group AB who sell: https://www.neuro-tech.io/products/access

Where Waher is CTO. And aligned with what I could recall from their hacked up reference pds which honestly looked vibe coded the code was that bad (which is why they took open source and made it closed source.

Feedback

On this page you can return feedback on the service.

Neuro Technology

Digitize Assets

⠠⠵ avuko

@avuko@infosec.exchange · 2 days ago

@thisismissem @elena @aral

I noticed it is all a bunch of guys who have "AB"s, all from Sweden. I guess they all know each other.

PS: I just had a quick look at auth., configuration looked the same.

Funny enough, auth.widentity.eu is now suddenly gone from my perspective. Maybe I've triggered som kind of WAV?

fires up tor browser.

Yes, they've blocked my IP.🙄

Edit: aaaaand... it's back😉

Elena Rossini on GoToSocial ⁂

@elena@aseachange.com · 2 days ago

@avuko whaaaaaat?!? Thank you for looking into this, if you don’t mind I’ll forward your findings to some techies who have helped me unpack things before. And LMK if I can quote you in a future piece @aral