How To Hack Facebook In 51 Seconds

#1

Post by jmorin007 » Fri, Mar 28, 2008, 10:22 PM UTC

How To Hack Facebook In 51 Seconds
alleyinsider.com

Re: How To Hack Facebook In 51 Seconds

#2

Post by earle » Fri, Mar 28, 2008, 10:28 PM UTC

Does this really surprise anyone?

When does security as an afterthought ever work?

Re: How To Hack Facebook In 51 Seconds

#3

Post by brianr » Fri, Mar 28, 2008, 10:48 PM UTC

This isn't really hacking Facebook... they're hacking the Moods app, which is made by HotOrNot.

Re: How To Hack Facebook In 51 Seconds

#4

Post by socmoth » Fri, Mar 28, 2008, 11:03 PM UTC

the moods app forgot to verify_sig on that request. i'm betting there are a lot of facebook apps like that.

Re: How To Hack Facebook In 51 Seconds

#5

Post by TheTarquin » Fri, Mar 28, 2008, 11:23 PM UTC

There've been some interesting articles on this topic in 2600 the past year or so. There was one (can't find it at the moment, will post a cite if I can dig it up) about viewing the information in sealed profiles and another about using an XSS attack to spoof friends request confirmations.

I don't recall much about the articles, but what I do recall are that, in each, the author noted that by the time he got the article written, the whole had been fixed.

Facebook is a big system, with a lot of possible holes, but it seems to be run by folks who care about security and respond well.

Re: How To Hack Facebook In 51 Seconds

#6

Post by mariorz » Sat, Mar 29, 2008, 12:18 AM UTC

socmoth wrote: post #4

the moods app forgot to verify_sig on that request. i'm betting there are a lot of facebook apps like that.

I don't see why there would be a lot. Client libs usually take care of that. I don't know what these guys are doing here.

Re: How To Hack Facebook In 51 Seconds

#7

Post by eusman » Sat, Mar 29, 2008, 12:18 AM UTC

quality in news is really decreasing

Re: How To Hack Facebook In 51 Seconds

#8

Post by rshao » Sat, Mar 29, 2008, 1:22 AM UTC

This isn't a facebook hack at all. It's a Moods application hack. Really, it's the application programmer's fault for not checking if the auth_token received corresponds to the fb_sig_user. James Hong's Pets application used to have the same problem, where you could sell other people's items to make money for your own pet. He just needed to validate his inputs...

And so do most amateurs web programmers.

Facebook is pretty secure. Its apps vary.

Re: How To Hack Facebook In 51 Seconds

#9

Post by [deleted] » Sat, Mar 29, 2008, 1:22 AM UTC

brianr wrote: post #3

This isn't really hacking Facebook... they're hacking the Moods app, which is made by HotOrNot.

[deleted]

Re: How To Hack Facebook In 51 Seconds

#10

Post by brianr » Sat, Mar 29, 2008, 3:51 AM UTC

mariorz wrote: post #6

socmoth wrote: post #4

the moods app forgot to verify_sig on that request. i'm betting there are a lot of facebook apps like that.

I don't see why there would be a lot. Client libs usually take care of that. I don't know what these guys are doing here.

The client libs handle everything for you if you use fbml, since every request is proxied by facebook and has its own signature. If you use an iframe, like the Moods app and many other popular apps, requests go directly to your server, so you have to explicity include and validate a signature for each request.

It's still not terribly difficult, but most facebook app devs are trying to churn out apps and features so fast that there's no time for this kind of detail.