Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on a Facebook server

blog.scrt.ch

Post reply on HN
Print view View original

41–50 of 207 posts

Re: Remote Code Execution on a Facebook server

#41

Post by bpicolo »

Someone1234 wrote: post #29
Areading314 wrote: post #7

This is a great concrete example why you should never run debug mode on a public server. Django can only do so much for redacting private info. This is also a great example of how insecure pickle is!

I know this is going to get some jeering, but that's one nice thing about .Net's machine.config , you designate the machine itself as a non-development environment and tracing, debug output, and so on are disabled for all .Net/ASP.Net applications. That might not work for all edge cases, but broadly there's a lot of machines which are only for non-development/production code, and a system-wide setting makes you a lot…

You can use env vars to do similarly for all the big frameworks (django, rails, etc)

Re: Remote Code Execution on a Facebook server

#42

Post by C14L »

exikyut wrote: post #2

So, this was simply taking advantage of a crash-prone webapp running on a debug-enabled Django instance using Pickle session serialization, and more specifically this was only possible because _Django didn't redact the stored secret key used to sign serialized inputs out of the crashdump information!_ Did the author tell Django about this yet, or is this a (possibly unintentional) 0-day? Besides the above interesting…

It was a Sentry specific "secret-key" that was overriding Django's.

Re: Remote Code Execution on a Facebook server

#43

Post by srcmap »

lmm wrote: post #37
srcmap wrote: post #23

Other than fixing the Django source code , is there any OS level mitigation techniques that can detect and prevent such security vulnerabilities? I am thinking something like selinux, docker or chroot - a bit like internal firewall for Django (or any other webapp). Any suggestions on the links to latest best practices?

There's nothing to be done at the OS level, because the OS doesn't know which things are secret and which things aren't. You can sandbox the Django process (and to a certain extent Facebook were doing this at an even higher level, by having the whole server on a separate VLAN that was (supposedly) away from the important stuff) but that only does so much because the process needs to have enough access to do whatever…

I am hoping a security subsystem that detects call to external programs (such as sleep in this case) , log them and raise alarm if not in a whitelist.

Re: Remote Code Execution on a Facebook server

#44

Post by gandreani »

Someone1234 wrote: post #29
Areading314 wrote: post #7

This is a great concrete example why you should never run debug mode on a public server. Django can only do so much for redacting private info. This is also a great example of how insecure pickle is!

I know this is going to get some jeering, but that's one nice thing about .Net's machine.config , you designate the machine itself as a non-development environment and tracing, debug output, and so on are disabled for all .Net/ASP.Net applications. That might not work for all edge cases, but broadly there's a lot of machines which are only for non-development/production code, and a system-wide setting makes you a lot…

Just a thought. This might actually be trivial to implement in a unix environment from the administration side of things. I'm not 100% sure but all child processes inherit the env vars from the parent correct? So setting `environment=production` high up in the process tree should make it available to all processes.

There's still chances of this getting overridden down the line and all apps have to conform to one style but at least it's possible?

Re: Remote Code Execution on a Facebook server

#47

Post by alrs »

konraditurbe wrote: post #13
gandreani wrote: post #6

Nice job! I also really appreciate the lack of memes and very concise format of this blog post

Also the title. Clear and concise without being click-bait (such as Facebook RCE for fun and profit, all your Facebook belong to us, etc...)

Those kinds of titles are really tired, but clickbait is unfair. "X For Fun and Profit" can be found in g-files back to the late '80s, a time well before clicking.

http://www.textfiles.com/phreak/

Re: Remote Code Execution on a Facebook server

#48

Post by mirimir »

mandeepj wrote: post #45

> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?

Using whois and BGP tools, I suspect.

Edit: https://bgp.he.net/search?search%5Bsearch%5D=facebook&commit...

    ...
    157.240.18.0/24
    ...
Also see https://bgp.he.net/net/157.240.18.0/24#_whois
Post reply on HN