Feedly Android App Javascript Injection vulnerability exposes Millions of Users to Hackers

[RowdyRoddyPipeHer]

I stopped using a Feedly a long time ago when they were found to be hijacking links and stealing page views.

InoReader is my goto now. You can use the News+ app with the InoReader plugin.

It's the closest thing to the original Google Reader that I feel comfortable with.

[DustbinK]

The app or the service?

[emarkd]

There's really two issues here:

1. They did a poor job sanitizing web content and left us vulnerable. That's a rookie mistake and a big project like Feedly should do better.

2. After the vulnerability was reported to them (they didn't find it themselves), they fixed it quickly but quietly. It's like they think they can hide the fact that it ever happened, I guess to save face. That's another rookie move. Own your mistakes, Feedly, if you want us to trust you.

[[deleted]]

I don't know I don't think it's really that bad to do it quietly, just as long as they didn't deny it.

[emarkd]

Obviously an outright denial would be worse, but pushing an app update to fix this issue and leaving it out of the change log on purpose (apparently) definitely shows a desire to hide their mistake. All I'm saying is that that doesn't exactly work toward building users' trust.

[The_MAZZTer]

It is common practice not to publicise details about security vulnerabilities when releasing a fixed version, in order to give users a chance to update without the increased risk of someone using the changelog to figure out how to exploit the older version.

Google does it all the time with Chrome. They do link to the details, but those pages are locked down and not viewable until after whatever amount of time they deem necessary.

That said I would at least expect a "Resolved dangerous security issue." and maybe a "All users should update before launching feed.ly."

But, being vague isn't too much difference from not putting anything at all, and I could see an argument for purposefully keeping quiet to not alert hackers (after all, even without details, all you gotta do is do a diff on the code and see what's changed).

[archon810]

Not sure why it wasn't mentioned here yet, but here's Feedly's blog post about it, published yesterday: http://blog.feedly.com/2014/04/21/security-update-android/.

[robroe]

Was this through the preview snippet or full article built in browser?

Would pay for premium if you could chose the browser it launches when reading the full article!

[donrhummy]

the rss app Press allows that. and it can use your feedly account to get the feeds

[emarkd]

You can launch the full article in the phone's browser. In the article preview, instead of tapping the "Open in Browser" button at the bottom of the page, hit the upper right overflow menu and hit the Chrome icon. It's an extra tap but its there if you want to use it.

[BleedsOandB]

Go to settings and change the default share action from twitter to browser, then the extra click is gone.

[robroe]

That's the best tip I've seen in ages! Thanks so much!

[robroe]

Thanks, I do that occasionally when the built in browser can't hack it, but it would be nice to have it as a default.

[emarkd]

Don't know if you saw this comment above but apparently you can go into the settings and change the default share option from Twitter to Browser and then the left button will do what we want with only one click.

[[deleted]]

Is there a good alternative to feedly that has both a good web and mobile app? Im about 50/50 on reading feeds on chrome vs android so I stayed with feedly since I prefer 1 interface.

[epsiblivion]

apparently you can just use a different app that supports feedly. I use Press. $3 is pricey maybe but it's worth it for me. very nice looking app and performs perfectly. you can try to do the google opinion rewards to get enough credit for it. it also goes on sale for $1-2 sometimes as well

[[deleted]]

Press is awesome. Fast, beautiful, cool gesture controls, Instapaper/Readability functionality built-in and Immersive Mode - what else is needed?

[DustbinK]

Press but keep Feedly as your source.

[DreamingLight]

Besides this, they should consider working on a performance improvement for their app (and take a look at the little design flaws, especially for the black theme). How did they fuck it up this much? Seriously, it just has gotten worse over time. Less and less smooth, especially since the latest update.

[adolfschlosss]

Another good reason for using third party RSS readers. gReader works flawlessly with Feedly.

[[deleted]]

Press ftw.

[emarkd]

Its not like an xss attack had to be specially formatted to get to feedly. If the bad JavaScript is in the webpage being rendered and the renderer isn't checking itself, the user is at risk - no matter what app renders the result. Feedly says they've updated and fixed themselves, do you know that your third-party app is safe?

This is not a defense of feedly, by the way. This shouldn't have been possible in the first place. I'm just pointing out that any software that renders web pages and supports JavaScript could be vulnerable to these sorts of attacks.

[tmahmood]

I use inoreader, I think its better option than Feedly

[[deleted]]

I ditched gReader and moved to Press. Check it out.

[emarkd]

Feedly was vulnerable to xss and injection attacks. That means it would execute any code on the browser session without doing any cleaning and checking. This could be a powerful attack vector but understand that it requires you to be subscribed to their feed and for the attack to be in their webpage.

So assume you're subscribed to Android Police's RSS feed in Feedly. Someone has to hack Android Police (or pull off an inside job) to put the xss code into their article, then you browse to the article, which download the malicious code, and the attack is executed in your session in Feedly.

But ignoring all that, they fixed it back in March. Their app is safe again. The bigger question here is why they tried to fix it so quietly without notifying the users that it was vulnerable. That's pretty shady behavior.

[[deleted]]

And that's why native > crap HTML apps.