Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I could have hacked any Facebook account

anandpraka.sh

Post reply on HN
Print view View original

141–150 of 168 posts

Re: How I could have hacked any Facebook account

#141

Post by restalis »

ghayes wrote: post #12
cphoover wrote: post #8

Frankly I think the amount being award by these companies is minuscule when you compare it to the amount of damage this information could have caused Facebook in the wrong hands.

I suspect most whitehat researchers would be happier to report this vulnerability and make a nice legal reward, then delve into a black hat market for selling a vulnerability. Seems pretty win-win in this case.

By reporting the problem to the owner you should assume that it might get fixed before you'll manage to sell it to other interested parties.

Re: How I could have hacked any Facebook account

#142

Post by GrinningFool »

unabridged wrote: post #62
dsacco wrote: post #27

Earlier quoted context omitted.

This has been discussed many, many times on HN before. This bug would not cause Facebook much damage; in fact, Facebook and Google tend to overpay rewards for bugs for the purposes of goodwill and recruiting. Let's examine the facts: 1. A Facebook vulnerability is dangerous to Facebook. A WordPress vulnerability is dangerous to a quarter of the internet. Facebook is not a high value target, relatively speaking. 2. A…

>Say they buy it for $20,000. Do you really think someone will derive $20,000 of profit from this before it's caught and patched by Facebook? FB is publicly traded at very high volume. You can make very large bets on its movement without being noticed. A hack of 10 celebrity facebook pages could probably drop the stock 5% in one day. You'd probably be able to make at least 20 to 1 on your money using options. The rig…

You overestimate how much investors [and the public at large] care about this. Security issues with banks are regular occurrence - yet you don't see Chase's stock drop with every announcement of stolen CC numbers. To investors it's not worth considering unless it's catastrophic and ongoing.

Re: How I could have hacked any Facebook account

#143

Post by benmmurphy »

cookiemonsta wrote: post #102
mabbo wrote: post #23

Earlier quoted context omitted.

During the fiasco that was the last white-hat hacker to report he'd hacked Facebook, I posted this: > Bug bounties are supposed to represent a high probability payoff of a lesser amount of money for finding a bug. This is in comparison to going the black hat sales root, where probability of sale might be lower, but the payoff might be higher. I can imagine one or two state actors who might pay top dollar to have keys…

where do people even go to start to sell an exploit? how does that kind of stuff work?

for exploits that don't target a single deployed instance there is a 'grey/white' market. off the top of my head: ZDI (more defence oriented. i think they distribute just signatures for intrusion detection), Zerodium (more offence oriented), Exodus Intel EIP (not really sure.. they distribute a feed)

Re: How I could have hacked any Facebook account

#144

Post by restalis »

tptacek wrote: post #68
arcticfox wrote: post #34

Earlier quoted context omitted.

What are you talking about? Facebook is not a "high value target" and "this bug would not cause Facebook much damage"? For example, if you wanted to monetize it, I have to imagine TMZ (or someone even less scrupulous) would pay a lot of money for dumps of A-list celeb and athlete Facebook accounts. You don't think Facebook having "The Fappening Part 2" on their hands is worth more than $15k to prevent? Or having ever…

He's right, and you are indeed recapitulating a discussion that has happened a zillion times on HN before. At some point (maybe I haven't read far enough down on the thread), The Grugq will chime in and confirm it, just in case you were doubting it. This isn't specific to Facebook; it's a common misapprehension of how bugs are valued for all SaaS companies. People don't pay top dollar for speculative bugs. I'm sure t…

You may choose (like you actually do) to make-believe whatever you wish about the exploits' worthlessness, but you may also assume that there already were a lot of black hats out there that provided "service" relying on the recently covered security weakness.

Also, about the "Facebook's security team is one of the strongest and most sophisticated of any company" mantra, even a mediocre strategist after knowing at least something about his opponents can improve his attack based on that knowledge. Assuming a modicum of surveillance on traffic dynamic from Facebook security team's part, this may translate into hiding the signature of a brute-force attack by spreading it into space (using a botnet) and time (spreading out a little each individual trial), or into a more elaborate method.

Re: How I could have hacked any Facebook account

#145

Post by logfromblammo »

amelius wrote: post #125
DigitalJack wrote: post #114

Earlier quoted context omitted.

same place as silk road.

Not sure if this is a good idea. Probably lots of undercover three-letter government agents lurking there.

Why is that a bad idea? If you sell to one of them, you will most certainly get paid in full and on time.

Or were you thinking that they would try to bust you for illegal hacking instead?

Re: How I could have hacked any Facebook account

#147

Post by TACIXAT »

orionblastar wrote: post #26
dsmithatx wrote: post #24

This has me thinking about another possible attack. Say I don't want to hack all of Facebook or a specific account. What if I used a botnet to reset passwords and then use the six attempts randomly on each account I reset. Sure I'd only get a small percentage but, I would easily start hacking FB accounts. It's things like this that make me use 2FA as much as possible on personal data.

2FA is nice unless you lose your cell phone or it gets stolen. If you ever lose your job or go homeless and can't afford a cell phone then you are locked out of your accounts. I am disabled and struggling if I miss payments I go homeless or can't pay my bills and things get shut off. For me 2FA might not work if I am down on my luck.

I recently bought the cheapest phone I could find for 2FA. 10$ phone and 20$ minutes. It equated for 400 texts with a time limit of 3 months. I didn't do too much research but there are probably some that don't expire. So, if you ever find yourself in a tough spot, 30$ can get you access. If you ever can't afford 30$, get in touch and I'll send you a phone.

Re: How I could have hacked any Facebook account

#148

Post by FilterSweep »

brbsix wrote: post #127
vbezhenar wrote: post #119

Earlier quoted context omitted.

Another factor is that when you are buying on black market, you can't be sure whether you are buying real exploit or fake one. Exploit owner probably will request (irreversible) bitcoin payment, will communicate via anonymous channels and is unlikely to give out details about that exploit until he's got his money. So both sides have difficulty trusting each other. Probably solution is some trusted 3-rd party, but is…

Even if you aren't able to receive some sort of sample proof of work (which is probably not the case with this exploit), you can still mitigate the risk by ensuring the seller has high status in the marketplace and/or is willing to use escrow (or preferably multi-sig) to ensure funds are only released upon receipt.

You totally can demonstrate it in this case, but I see how you are correct in most other cases.

" Do you have a facebook account? Name a friend, and I'll prove it to you "

Re: How I could have hacked any Facebook account

#149

Post by edanm »

blablablame wrote: post #139
dsacco wrote: post #35

Earlier quoted context omitted.

Your comment does not reflect how vulnerability sales work in the real world. In the real world, vulnerabilities are sold to blackhat groups who want to make a profit by attacking as many websites as possible. Generally, these websites will have valuable credit card or other information that can be stolen from a compromised server. Compromised user accounts (not even the server! just users!) on a single website do no…

Step one: short a million on Apple shares Step two: hack into Tim Cook's account (no idea if he uses FB) Step three: publish rant about Apple rotten ideoligies/he quits Step four: see APPL lose value for a day until this shit is sorted Step five: profit Or something like that

Step 6 - go to jail.

Step 7 - get out of jail and decide doing far less risky illegal stuff has a better expected payout.

Re: How I could have hacked any Facebook account

#150

Post by tptacek »

restalis wrote: post #144
tptacek wrote: post #68

Earlier quoted context omitted.

He's right, and you are indeed recapitulating a discussion that has happened a zillion times on HN before. At some point (maybe I haven't read far enough down on the thread), The Grugq will chime in and confirm it, just in case you were doubting it. This isn't specific to Facebook; it's a common misapprehension of how bugs are valued for all SaaS companies. People don't pay top dollar for speculative bugs. I'm sure t…

You may choose (like you actually do) to make-believe whatever you wish about the exploits' worthlessness, but you may also assume that there already were a lot of black hats out there that provided "service" relying on the recently covered security weakness. Also, about the "Facebook's security team is one of the strongest and most sophisticated of any company" mantra, even a mediocre strategist after knowing at lea…

Don't move the goalposts. I'm not saying there aren't black hats that target Facebook. I'm saying none of them will pay $15000, or even $500, for this or any other Fb bug.
Post reply on HN