101–110 of 207 posts
The fact that the machine has a hostname "*.thefacebook.com" doesn't imply that it also runs software of the "Facebook" social media software. So not sure how much impact this exploit would have had.
This is why you (looking at frameworks) should never use a format that may contain code to store data, especially when the client has control over that data (even if signed). The same vulnerability has occurred in almost every language/framework that does this, including Rails and Java-based ones. Just use something like JSON, which completely avoids code execution vulnerabilities like this. Except of course for the…
Facebook joins Patreon in the "why somebody should make sure our python web framework debug mode isn't enabled in prod" club.
Patreon's screw-up was a lot more embarassing though - they apparently left an actual Python shell exposed to the web for at least a week after someone warned them about it, and their entire user database was exfiltrated and posted on the net as a result.
Facebook has had vulnerabilities and exposures, but nothing like that.
This is why you (looking at frameworks) should never use a format that may contain code to store data, especially when the client has control over that data (even if signed). The same vulnerability has occurred in almost every language/framework that does this, including Rails and Java-based ones. Just use something like JSON, which completely avoids code execution vulnerabilities like this. Except of course for the…
Also debug mode in production is just lazy.
Earlier quoted context omitted.
I don't think anyone will ever know how much impact, but it implies that Facebook is not good at security.
No one talks about the working parts of security. Like, in this case, having the application on a separate box, and having that box separated by vlans from important things.
Earlier quoted context omitted.
He should have gone to the black market, better yet sat on it. How long did it take Facebook to come forward with its user privacy violations?
He deserves a higher payout, but 1) telling him to be unethical rather than reporting it responsibly and accepting a not-insignificant reward is stupid, and 2) there's almost no chance this would've garnered more than $5,000 on any black market. This is not something that would grant a cybercriminal access to sensitive or profitable information, unless Facebook is wrong in their assessment of how segmented the server…
> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?
https://www.shodan.io/search?query=net%3A199.201.65.0%2F24&l...
Login required
The fact that the machine has a hostname "*.thefacebook.com" doesn't imply that it also runs software of the "Facebook" social media software. So not sure how much impact this exploit would have had.
thefacebook.com was their original domain from way way back in the day. The fact this system has a legacy DNS entry might indicate its age.