Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on a Facebook server

blog.scrt.ch

Post reply on HN
Print view View original

151–160 of 207 posts

Re: Remote Code Execution on a Facebook server

#151

Post by kashyapc »

sdegutis wrote: post #145
alrs wrote: post #73

Earlier quoted context omitted.

I'm in absolute agreement. Nerd-culture has been on autopilot for decades and needs to find its next level.

This is a really interesting topic to me, because I've felt a pull toward things like this myself and seen it for decades. For example, the top of the README in my Zephyros project[1] was very playfully done, and very well received too. People are naturally more lighthearted and organic than the sterile software and documentation we tend to write, and we're more social too, wanting to connect with others even if it m…

I am not saying to not be human and take all the zest out of the writing.

FWIW, I suggest the book On Writing Well. William Zinsser has valuable advice on how we can still retain humanity in our writing without being dull and lackluster when dealing with dry and "sterile" topics like software.

Re: Remote Code Execution on a Facebook server

#152

Post by Kiro »

> Pickle is a Python module used to serialize data, but contrarily to JSON or YAML, it allows to serialize objects properties but also methods. In most of the cases, this is not a problem, but one can also serialize an object with code in the __reduce__() method, which is called when the object is unpickled.

Why does it run __reduce__?

Re: Remote Code Execution on a Facebook server

#153

Post by AgentME »

srcmap wrote: post #43
lmm wrote: post #37

Earlier quoted context omitted.

There's nothing to be done at the OS level, because the OS doesn't know which things are secret and which things aren't. You can sandbox the Django process (and to a certain extent Facebook were doing this at an even higher level, by having the whole server on a separate VLAN that was (supposedly) away from the important stuff) but that only does so much because the process needs to have enough access to do whatever…

I am hoping a security subsystem that detects call to external programs (such as sleep in this case) , log them and raise alarm if not in a whitelist.

You don't need to make calls to external programs to make good use of an RCE vulnerability like this.

Re: Remote Code Execution on a Facebook server

#154

Post by Kiro »

jwilk wrote: post #127
tyleraldrich wrote: post #76

Earlier quoted context omitted.

You didn't read the article. "09.08.2018 20:10 CEST : a 5000$ bounty is awarded – the server was in a separate VLAN with no users’ specific data."

From the HN guidelines: Please don't insinuate that someone hasn't read an article.

Not applicable when it's obvious that the poster hasn't read the article, like in this case.

Re: Remote Code Execution on a Facebook server

#155

Post by detaro »

Kiro wrote: post #152

> Pickle is a Python module used to serialize data, but contrarily to JSON or YAML, it allows to serialize objects properties but also methods. In most of the cases, this is not a problem, but one can also serialize an object with code in the __reduce__() method, which is called when the object is unpickled. Why does it run __reduce__?

if it exists, __reduce__ is run when pickling the object and returns code that will be run when unpickling. It allows to completely customize how the object is re-created on the other side, which might be needed e.g. when the type is defined in a native extension (at least the docs name this use case).

Re: Remote Code Execution on a Facebook server

#156

Post by sterlind »

tptacek wrote: post #139
Grue3 wrote: post #131

Earlier quoted context omitted.

I remember the guy who broke into a Facebook server then used the information stored on that server to get onto a more important server with user data. He either didn't receive a bounty or got a reduced bounty because the server he accessed was deemed unimportant and chaining hacks is against the rules or something. Think it was this one: http://exfiltrated.com/research-Instagram-RCE.php (actually it's even worse tha…

That's not at all the whole story.

Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation.

If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.

Re: Remote Code Execution on a Facebook server

#157

Post by rrcaptain »

Areading314 wrote: post #7

This is a great concrete example why you should never run debug mode on a public server. Django can only do so much for redacting private info. This is also a great example of how insecure pickle is!

I think maybe frameworks should stop calling it debug mode and start calling it "danger mode". Because clearly people aren't paying attention to what it actually does.

Re: Remote Code Execution on a Facebook server

#158

Post by tptacek »

sterlind wrote: post #156
tptacek wrote: post #139

Earlier quoted context omitted.

That's not at all the whole story.

Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation. If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.

The researcher did not follow the rules to the letter. They found an in-scope RCE vulnerability, then dumped and saved the filesystem contents and used them, after reporting the bug, to compromise Facebook's AWS configuration. You would get in trouble for doing that even on a contracted penetration test, let alone a bug bounty. To make matters worse, the researcher did all this in a fit of pique about not being awarded a higher bounty.

There's a whole thread on HN about this.

Here's Alex Stamos' writeup:

https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

Re: Remote Code Execution on a Facebook server

#159

Post by shawn »

alexbecker wrote: post #146
shawn wrote: post #111

Earlier quoted context omitted.

This is really discriminatory and arrogant. I used to feel the same way. It’s worth changing.

I think they mean if you can tell that it's a .NET app (e.g. because they left the X-Powered-By header on), not if it's a .NET app in general.

Facepalm. I've filled my dumb comment quota for the week.

Well, at least it was clarified. It got a couple upvotes, so I guess others misinterpreted it too. Sorry.

Re: Remote Code Execution on a Facebook server

#160

Post by Sohcahtoa82 »

jwilk wrote: post #127
tyleraldrich wrote: post #76

Earlier quoted context omitted.

You didn't read the article. "09.08.2018 20:10 CEST : a 5000$ bounty is awarded – the server was in a separate VLAN with no users’ specific data."

From the HN guidelines: Please don't insinuate that someone hasn't read an article.

To be fair, it's a hard rule to follow sometimes when someone makes it painfully clear that they didn't actually read the article.
Post reply on HN