Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on a Facebook server

blog.scrt.ch

Post reply on HN
Print view View original

51–60 of 207 posts

Re: Remote Code Execution on a Facebook server

#51

Post by syntheticcdo »

srcmap wrote: post #43
lmm wrote: post #37

Earlier quoted context omitted.

There's nothing to be done at the OS level, because the OS doesn't know which things are secret and which things aren't. You can sandbox the Django process (and to a certain extent Facebook were doing this at an even higher level, by having the whole server on a separate VLAN that was (supposedly) away from the important stuff) but that only does so much because the process needs to have enough access to do whatever…

I am hoping a security subsystem that detects call to external programs (such as sleep in this case) , log them and raise alarm if not in a whitelist.

ThreatStack definitely does this, utilizing the OS-exposed auditing frameworks. There are probably open source alternatives as well, but I rely extensively on TS for server-level threat detection.

Re: Remote Code Execution on a Facebook server

#52

Post by Someone1234 »

gandreani wrote: post #44
Someone1234 wrote: post #29

Earlier quoted context omitted.

I know this is going to get some jeering, but that's one nice thing about .Net's machine.config , you designate the machine itself as a non-development environment and tracing, debug output, and so on are disabled for all .Net/ASP.Net applications. That might not work for all edge cases, but broadly there's a lot of machines which are only for non-development/production code, and a system-wide setting makes you a lot…

Just a thought. This might actually be trivial to implement in a unix environment from the administration side of things. I'm not 100% sure but all child processes inherit the env vars from the parent correct? So setting `environment=production` high up in the process tree should make it available to all processes. There's still chances of this getting overridden down the line and all apps have to conform to one styl…

Absolutely. But none of the major players are looking for it, and they all have unique ways of designating the machine that way.

There's no specific technological challenges, this is entirely political, getting half a dozen or more different projects with different priorities to check the same variable for the same purpose.

Re: Remote Code Execution on a Facebook server

#55

Post by tptacek »

srcmap wrote: post #23

Other than fixing the Django source code , is there any OS level mitigation techniques that can detect and prevent such security vulnerabilities? I am thinking something like selinux, docker or chroot - a bit like internal firewall for Django (or any other webapp). Any suggestions on the links to latest best practices?

Of course. You can lock the process down so that it can't make unexpected system calls. If you deploy in a modern container environment, you can also use container networking to drastically limit what the application environment can talk to on the network. Though it's a less potent mitigation than seccomp and container isolation (and one you get for free once you deploy in a container), you can also limit filesystem access. If you run the application under a non-privileged uid, these mitigations combined can raise the bar somewhat for privilege escalation and pivoting after compromise.

Of course, in a sense, Facebook appears to have accomplished something simpler simply by sacrificing an instance to this application and putting it on a lonely isolated VLAN.

The other responses to your question are pretty weird, since it's obvious that there are things you can do to mitigate the possibility of your Django program literally calling execve or whatever.

Re: Remote Code Execution on a Facebook server

#56

Post by craigmi »

mandeepj wrote: post #45

> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?

Plenty of organisations (especially one of Facebook's size) tend to have their own autonomous system numbers, pretty trivial to get the ranges from BGP announcements for any given ASN.

Re: Remote Code Execution on a Facebook server

#57

Post by jelly »

mandeepj wrote: post #45

> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?

Facebook, like many large internet companies, buys their IP blocks outright, so they show up under their AS number [0]. Facebook seems to have 3 AS numbers [1,2,3] and that IP appears in [3]

[0] https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%...

[1] https://bgp.he.net/AS32934

[2] https://bgp.he.net/AS63293

[3] https://bgp.he.net/AS54115

Re: Remote Code Execution on a Facebook server

#58

Post by joombaga »

mandeepj wrote: post #45

> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?

They're in the ARIN database. Just search for FACEBOOK-CORP

https://whois.arin.net/rest/net/NET-199-201-64-0-1

Re: Remote Code Execution on a Facebook server

#60

Post by mandeepj »

jrowley wrote: post #28
Cthulhu_ wrote: post #18

Wow, a fix in <24 hours, that's pretty impressive.

I mean the fix is toggling a single environmental variable from True to False, on a system that isn't normally accessed by customers, so the risk is really small in rolling out the change.

Facebook deploy updates in their prod 10-20 or even more, times a day
Post reply on HN