How I could have hacked any Facebook account • Hacker News Board

Re: How I could have hacked any Facebook account

#21

Post by dsmithatx » Tue, Mar 08, 2016, 9:58 PM UTC

Zikes wrote: post #7

jacquesm wrote: post #5

Earlier quoted context omitted.

Very disappointing comment. Everybody is free to choose to use facebook or not to use it. I chose not to use it, but I do not have the right or any moral obligation to stop others from using it. This guy did not have the right - and fortunately chose not to exercise it - to mess with other people's free choices in life. Besides that, the likely only effect any activity like you are suggesting would have had is that h…

Seeing as it's a brute-force per-account attack, a more accurate title would have been "How I could have hacked any Facebook account". Hacking "all of Facebook" would have been prohibitively resource-intensive for the hacker, and would likely have been caught and shut down before any real damage to the platform was done.

The hacker could of worked with the black market. They could use a botnet to slowly hack a large percentage of FB potentially. Seeing as how they disabled rate-limiting on a pubic facing beta with user data, why assume they would notice brute forcing against beta?

Re: How I could have hacked any Facebook account

#22

Post by msie » Tue, Mar 08, 2016, 9:59 PM UTC

Surprised that the well-paid developers at Facebook missed this vulnerability. Should inspire confidence on anyone who didn't get a job there. :-)

Re: How I could have hacked any Facebook account

#23

Post by mabbo » Tue, Mar 08, 2016, 10:02 PM UTC

cphoover wrote: post #8

Frankly I think the amount being award by these companies is minuscule when you compare it to the amount of damage this information could have caused Facebook in the wrong hands.

During the fiasco that was the last white-hat hacker to report he'd hacked Facebook, I posted this:

> Bug bounties are supposed to represent a high probability payoff of a lesser amount of money for finding a bug. This is in comparison to going the black hat sales root, where probability of sale might be lower, but the payoff might be higher. I can imagine one or two state actors who might pay top dollar to have keys to the kingdom to a major social network. (https://news.ycombinator.com/item?id=10756159)

Expected payout = (Probability of reward * size of reward) +/- any additional value I put into who I'm selling it to.

If I have an exploit that gives me a lot of access to Facebook (or any other large company) I have to run that formula for each entity that might pay me for it- Facebook, the NSA, the Chinese Military, and so on down the list. Facebook is offering high probability for a lower payout. The NSA might step up their game and start offering ten times as much, or make it more clear that they will indeed pay you for it (not that I have any proof they'd do such a thing).

Make no mistake, Facebook has probably done this math very carefully when choosing a bounty.

Re: How I could have hacked any Facebook account

#24

Post by dsmithatx » Tue, Mar 08, 2016, 10:02 PM UTC

This has me thinking about another possible attack. Say I don't want to hack all of Facebook or a specific account. What if I used a botnet to reset passwords and then use the six attempts randomly on each account I reset. Sure I'd only get a small percentage but, I would easily start hacking FB accounts. It's things like this that make me use 2FA as much as possible on personal data.

Re: How I could have hacked any Facebook account

#25

Post by unknownzero » Tue, Mar 08, 2016, 10:06 PM UTC

fatlasp wrote: post #20

unknownzero wrote: post #19

Anyone know what tool he was using in the YouTube video? This stuff is super interesting.

Looks like Burp Suite. Sweet web proxy tool -- https://portswigger.net/burp/ Free for 14 days I think.

Awesome! Thanks for the link. It looks like they have a limited free forever version as well, gonna have to play with this.

Re: How I could have hacked any Facebook account

#26

Post by orionblastar » Tue, Mar 08, 2016, 10:07 PM UTC

dsmithatx wrote: post #24

This has me thinking about another possible attack. Say I don't want to hack all of Facebook or a specific account. What if I used a botnet to reset passwords and then use the six attempts randomly on each account I reset. Sure I'd only get a small percentage but, I would easily start hacking FB accounts. It's things like this that make me use 2FA as much as possible on personal data.

2FA is nice unless you lose your cell phone or it gets stolen. If you ever lose your job or go homeless and can't afford a cell phone then you are locked out of your accounts.

I am disabled and struggling if I miss payments I go homeless or can't pay my bills and things get shut off. For me 2FA might not work if I am down on my luck.

Re: How I could have hacked any Facebook account

#27

Post by dsacco » Tue, Mar 08, 2016, 10:08 PM UTC

cphoover wrote: post #8

Frankly I think the amount being award by these companies is minuscule when you compare it to the amount of damage this information could have caused Facebook in the wrong hands.

This has been discussed many, many times on HN before. This bug would not cause Facebook much damage; in fact, Facebook and Google tend to overpay rewards for bugs for the purposes of goodwill and recruiting.

Let's examine the facts:

1. A Facebook vulnerability is dangerous to Facebook. A WordPress vulnerability is dangerous to a quarter of the internet. Facebook is not a high value target, relatively speaking.

2. A Facebook vulnerability will be patched once it is widely used. Facebook's security team is one of the strongest and most sophisticated of any company, and their processes would quickly catch this once it was used. The total impact of the bug would be negligible. You'd lose the ability to compromise accounts as soon as you tried to do it in any meaningful or lucrative way.

3. A vulnerability in Facebook might last a week before being patched, but a vulnerability in PHP will persist on the internet for years. No matter how many individual sites patch their servers, you'll still be able to pop a lonely server with social security numbers chugging along in a closet somewhere.

There really isn't much more to say about this. People claim bounties awarded by Facebook/Google/et al are undervalued every single time a bug bounty hits the front page of HN. Every single time, someone who is in the security industry patiently explains why it's not that valuable.

If someone tried to go to a blackhat group or go to the "black-market" (a shadowy, lucrative place that never seems to be very well-defined in these conversations), he would not even be able to find a seller, let alone one who would pay a lot.

What do you imagine someone would pay for this on the black-market? They'd need to profit from it. How much profit is worth their time?

Say they buy it for $20,000. Do you really think someone will derive $20,000 of profit from this before it's caught and patched by Facebook?

The only vulnerability worth $15,000 or more is one directly impacting a language, a widely used development library/framework or a widely used piece of software.

For further reading on bug bounty valuation:

https://news.ycombinator.com/item?id=7106953

https://news.ycombinator.com/item?id=9302188

https://news.ycombinator.com/item?id=9040855

https://news.ycombinator.com/item?id=9041017

https://news.ycombinator.com/item?id=8563884

Re: How I could have hacked any Facebook account

#28

Post by thrownn » Tue, Mar 08, 2016, 10:09 PM UTC

On the subject of rate limiting, what is the best way to apply it across all endpoints, APIs and resources, external and internal, with minimal effort?

Usually, I see this implemented only as an afterthought, and only on endpoints deemed 'dangerous', waiting for a disaster like this to happen...

Re: How I could have hacked any Facebook account

#29

Post by dsmithatx » Tue, Mar 08, 2016, 10:12 PM UTC

orionblastar wrote: post #26

dsmithatx wrote: post #24

This has me thinking about another possible attack. Say I don't want to hack all of Facebook or a specific account. What if I used a botnet to reset passwords and then use the six attempts randomly on each account I reset. Sure I'd only get a small percentage but, I would easily start hacking FB accounts. It's things like this that make me use 2FA as much as possible on personal data.

2FA is nice unless you lose your cell phone or it gets stolen. If you ever lose your job or go homeless and can't afford a cell phone then you are locked out of your accounts. I am disabled and struggling if I miss payments I go homeless or can't pay my bills and things get shut off. For me 2FA might not work if I am down on my luck.

There are ways around this for some things but, probably not with services like Facebook. For example with Amazon I use 2FA with a cellphone. As a backup I use a hardware token and an Admin account. If my cellphone gets stolen I pull the 2FA card out of my wallet.

Re: How I could have hacked any Facebook account

#30

Post by at-fates-hands » Tue, Mar 08, 2016, 10:15 PM UTC

ghayes wrote: post #12

cphoover wrote: post #8

Frankly I think the amount being award by these companies is minuscule when you compare it to the amount of damage this information could have caused Facebook in the wrong hands.

I suspect most whitehat researchers would be happier to report this vulnerability and make a nice legal reward, then delve into a black hat market for selling a vulnerability. Seems pretty win-win in this case.

Unless your name is Kevin Mitnick. Then you set up a business and play middlemen in selling them to anybody who wants to pony up for it.

"When we have a client that wants a zero-day vulnerability for whatever reason, we don’t ask, and in fact they wouldn’t tell us,” Mitnick tells WIRED in an interview. “Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.”

http://www.wired.com/2014/09/kevin-mitnick-selling-zero-day-...