Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Network Breach Impacts Up to 50M Users

nytimes.com

Post reply on HN
Print view View original

31–40 of 635 posts

Re: Facebook Network Breach Impacts Up to 50M Users

#31

Post by throwawaymath »

rajathagasthya wrote: post #13

> This attack exploited the complex interaction of multiple issues in our code. It stemmed from a change we made to our video uploading feature in July 2017, which impacted “View As.” Obviously, Facebook is an extremely complicated system. But I find it hard to believe a video uploading feature would impact 'View As'.

It's very easy for me to believe. "View As" is an authorization and authentication sensitive, limited user impersonation feature. Video uploading interacts with, and complicates, authorization in an application with fine grained privacy and permission models.

It's intuitively straightforward that modifying code for uploading videos could (read: not should) have authorization and authentication ramifications. One of those ramifications could then result in a vulnerability chain compromising user impersonation functionality.

I have seen far, far more incredulous head scratchers in penetration tests and code reviews. The interaction boundaries of, or middleware between, two seemingly unrelated systems is generally a good start to look for a security vulnerability.

Re: Facebook Network Breach Impacts Up to 50M Users

#32

Post by red_admiral »

I find facebook's effects on privacy and democracy as scary as the next person, but so far their secure coding standards have been extremely high. They're one of the few big names NOT on haveibeenpwned.com, they run their passwords through a KDF and then encrypt the result with a hardware security module, and a whole lot of other good things.

I guess even the best (at secure coding) sometimes mess up.

Re: Facebook Network Breach Impacts Up to 50M Users

#33

Post by sp332 »

erichurkman wrote: post #7
sdwisely wrote: post #4

Earlier quoted context omitted.

> But it’s clear that attackers exploited a vulnerability in Facebook’s code that impacted “View As”, a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts oh boy, what a mess.

User impersonation code always terrifies the bajeebus out of me.

You only get to see your own profile. It's a very useful tool to make sure you're not leaking data you people you'd rather not give it to.

Re: Facebook Network Breach Impacts Up to 50M Users

#36

Post by ummonk »

dawhizkid wrote: post #9

Is it wrong to be glad FB's reputation has tarnished (and stock price sideways) over the past year or so? For so long they've monopolized the talent pool in the Bay Area. If more people decide 1) they don't want to work at FB and 2) FB employees are itching to leave then I see any stain on FB's employment brand as a net positive to the greater tech + startup ecosystem.

How have they monopolized the talent pool? By paying their employees better than everyone else?

Re: Facebook Network Breach Impacts Up to 50M Users

#37

Post by wfwefwef32 »

Recently talked to 2 friends working for fb. According to them, the culture there is very toxic. For a master's degree, once get in, you need to get promoted in 22 months (I might misremember the actual number.) or you will have to leave. Debugging is never counted as a real work, so for quick promotion, nobody wants to solve bugs unless a bug becomes too obvious. And they also complained about no work-life balance. They got pushed to check-in code at 12a.m. for example.

Re: Facebook Network Breach Impacts Up to 50M Users

#40

Post by r3bl »

microwavecamera wrote: post #23
coldcode wrote: post #5

Did not mention what was leaked/taken or how 50M and not everyone.

Or why FB waited almost a week to tell us.

> On the afternoon of Tuesday, September 25, our engineering team discovered a security issue affecting almost 50 million accounts.

Now it's 28th, meaning that they've disclosed the breach within 72 hours, as requested by at least one regulation (Article 33 of the GDPR).

That's clearly not even half a week.

Post reply on HN