Remote Code Execution on a Facebook server

Post by tptacek » Fri, Aug 24, 2018, 7:51 PM UTC

GordonS wrote: post #136

tptacek wrote: post #55

Earlier quoted context omitted.

Of course. You can lock the process down so that it can't make unexpected system calls. If you deploy in a modern container environment, you can also use container networking to drastically limit what the application environment can talk to on the network. Though it's a less potent mitigation than seccomp and container isolation (and one you get for free once you deploy in a container), you can also limit filesystem…

> You can lock the process down so that it can't make unexpected system calls Huh, this isn't something I've ever come across before. Off the top of my head, I guess it would be possible on Windows using a kernel mode driver, but that's pretty hardcore, and really easy to get wrong. I know you can easily audit syscalls on Linux with auditd, but haven't seen preventing them before. Is this an option on both Linux and…

Post by panopticon » Fri, Aug 24, 2018, 7:58 PM UTC

wereHamster wrote: post #95

Someone1234 wrote: post #29

Earlier quoted context omitted.

I know this is going to get some jeering, but that's one nice thing about .Net's machine.config , you designate the machine itself as a non-development environment and tracing, debug output, and so on are disabled for all .Net/ASP.Net applications. That might not work for all edge cases, but broadly there's a lot of machines which are only for non-development/production code, and a system-wide setting makes you a lot…

I don't know what the standard way is to deploy django or .net apps, but nodejs apps are often packaged into a docker container, or cloud function, that run independently, not on any particular machine that you designate as 'production'. So 'system-wide' settings don't really exist because there is no concept of a machine. With nodejs in a docker contianer for example you specify whether the server is designated for…

Post by sdegutis » Fri, Aug 24, 2018, 8:09 PM UTC

alrs wrote: post #73

kashyapc wrote: post #66

Earlier quoted context omitted.

The point is, "for fun and profit" is such an overused and utterly boring cliché. Meaningful titles are pleasant to read and shows that the writer has put some effort to bring clarity into what they're trying to convey. (As someone who sits on a major open source conference talk panel, I cringe when I see one of these clichés slapped into the title without much thought. I politely suggest to rephrase to convey more "…

I'm in absolute agreement. Nerd-culture has been on autopilot for decades and needs to find its next level.

Post by collinmanderson » Fri, Aug 24, 2018, 8:22 PM UTC

matharmin wrote: post #83

This is why you (looking at frameworks) should never use a format that may contain code to store data, especially when the client has control over that data (even if signed). The same vulnerability has occurred in almost every language/framework that does this, including Rails and Java-based ones. Just use something like JSON, which completely avoids code execution vulnerabilities like this. Except of course for the…

Post by collinmanderson » Fri, Aug 24, 2018, 8:31 PM UTC

TheDong wrote: post #140

smsm42 wrote: post #126

So, summarily we have: 1. Enabling debug mode in production 2. Running publicly-accessible app with publicly-accessible crash screens without any monitoring system noticing it's happening 3. Relying on auto-cleaning in debug facilities to sanitize security information (never works) 4. Using over-powered serialization protocol which allows for code execution for storing user-accessible data 5. Thinking that merely sig…

Note that 5 is true though. Using a secret to sign or encrypt a cookie does normally work, and it's a common practice. Usually the impact of the secret leaking is that you can impersonate anyone, not that you can run arbitrary code, but the practice of using a session secret is common and not a bad practice nor broken inherently. 3 as well I think is unfair. That isn't something facebook implemented or is relying on;…