Security News > 2020 > February > SoundCloud Tackles DoS, Account Takeover Issues

Online music platform SoundCloud, which can be thought of as an audio-based YouTube for music creators, has addressed several security bugs in its APIs that could lead to denial-of-service or account takeover via credential-stuffing.

According to researcher Paulo Silva of Checkmarx Security Research, three different groups of security vulnerabilities were found in the platform: A authentication issue which could lead to account takeover; a rate-limiting bug that could lead to DoS; and an improper input validation.

The broken authentication issue has to do with not having a set number of login tries before locking someone out of the account - which opens the door to unlimited brute-force attacks from cybercriminals trying to guess passwords.

"The /sign-in/password endpoint of api-v2.soundcloud.com does not implement proper account lockout based on failed authentication attempts," according to Silva, in an analysis posted Tuesday.

For its part, SoundCloud promptly fixed the problem and sent out a statement: "At SoundCloud, the security of our users' accounts is extremely important to us. We are always looking for ways to enhance the security of our platform for our users. We appreciate Checkmarx reaching out to discuss their findings."

News URL

https://threatpost.com/soundcloud-dos-account-takeover/152838/