Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on a Facebook server

blog.scrt.ch

Post reply on HN
Print view View original

91–100 of 207 posts

Re: Remote Code Execution on a Facebook server

#91

Post by Jwarder »

mandeepj wrote: post #79

> I found a Sentry service hosted on 199.201.65.36 I do not remember on top of my head now but I think there are few scanning software to find all the running apps on a remote machine. If you are aware then please share

I've used nmap to check for open ports. Not 1:1 for running applications, but an easy way to check for mistakes when making a machine public.

I've also seen plenty of references to shodan.io, but I have no experience with it.

Re: Remote Code Execution on a Facebook server

#92

Post by meowface »

0x8BADF00D wrote: post #71
green_on_black wrote: post #69

He got $5k for an arbitrary remote execution bug? What a rip-off.

He should have gone to the black market, better yet sat on it. How long did it take Facebook to come forward with its user privacy violations?

He deserves a higher payout, but 1) telling him to be unethical rather than reporting it responsibly and accepting a not-insignificant reward is stupid, and 2) there's almost no chance this would've garnered more than $5,000 on any black market. This is not something that would grant a cybercriminal access to sensitive or profitable information, unless Facebook is wrong in their assessment of how segmented the server is... and even then, much more work would be required for the attacker (more than an average vuln buyer is probably capable of).

Re: Remote Code Execution on a Facebook server

#93

Post by westmeal »

Shish2k wrote: post #75
kashyapc wrote: post #66

Earlier quoted context omitted.

The point is, "for fun and profit" is such an overused and utterly boring cliché. Meaningful titles are pleasant to read and shows that the writer has put some effort to bring clarity into what they're trying to convey. (As someone who sits on a major open source conference talk panel, I cringe when I see one of these clichés slapped into the title without much thought. I politely suggest to rephrase to convey more "…

As someone who attends open source conferences, thank you for your efforts to keep talk titles meaningful :) (My pet peeve being "$thing 2: electric boogaloo", which just seems to be filling up space with nonsense words - at least "for fun and profit" makes gramatical sense...)

shish2k: electric boogaloo

Re: Remote Code Execution on a Facebook server

#95

Post by wereHamster »

Someone1234 wrote: post #29
Areading314 wrote: post #7

This is a great concrete example why you should never run debug mode on a public server. Django can only do so much for redacting private info. This is also a great example of how insecure pickle is!

I know this is going to get some jeering, but that's one nice thing about .Net's machine.config , you designate the machine itself as a non-development environment and tracing, debug output, and so on are disabled for all .Net/ASP.Net applications. That might not work for all edge cases, but broadly there's a lot of machines which are only for non-development/production code, and a system-wide setting makes you a lot…

I don't know what the standard way is to deploy django or .net apps, but nodejs apps are often packaged into a docker container, or cloud function, that run independently, not on any particular machine that you designate as 'production'. So 'system-wide' settings don't really exist because there is no concept of a machine.

With nodejs in a docker contianer for example you specify whether the server is designated for production or not during build time, not when you run it.

Re: Remote Code Execution on a Facebook server

#96

Post by tetha »

bluntfang wrote: post #82
amelius wrote: post #81

The fact that the machine has a hostname "*.thefacebook.com" doesn't imply that it also runs software of the "Facebook" social media software. So not sure how much impact this exploit would have had.

I don't think anyone will ever know how much impact, but it implies that Facebook is not good at security.

No one talks about the working parts of security. Like, in this case, having the application on a separate box, and having that box separated by vlans from important things.

Re: Remote Code Execution on a Facebook server

#97

Post by makomk »

cc-d wrote: post #15

Facebook joins Patreon in the "why somebody should make sure our python web framework debug mode isn't enabled in prod" club.

Patreon's screw-up was a lot more embarassing though - they apparently left an actual Python shell exposed to the web for at least a week after someone warned them about it, and their entire user database was exfiltrated and posted on the net as a result.

Re: Remote Code Execution on a Facebook server

#98

Post by QuadrupleA »

Great article. Big frameworks like Django are nice to get an app started quickly, but if you use them long-term it really pays to study how they work under the hood, read some source code, etc. Although "don't run debug mode on production" is probably in the first page of the tutorial :)

Re: Remote Code Execution on a Facebook server

#99

Post by Someone1234 »

kawsper wrote: post #61
Someone1234 wrote: post #29

Earlier quoted context omitted.

I know this is going to get some jeering, but that's one nice thing about .Net's machine.config , you designate the machine itself as a non-development environment and tracing, debug output, and so on are disabled for all .Net/ASP.Net applications. That might not work for all edge cases, but broadly there's a lot of machines which are only for non-development/production code, and a system-wide setting makes you a lot…

Funnily enough, it is mostly .NET applications running in production that I see stack-traces from these days.

If you even know something is a .Net app then the developer is likely terrible, so it is a self-selecting sample. You don't know most of the .Net MVC apps you interact with because there's no reason to know that.
Post reply on HN