Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook security hole allows viewing of private photos

forum.bodybuilding.com

Post reply on HN
Print view View original

81–90 of 143 posts

Re: Facebook security hole allows viewing of private photos

#81

Post by kristopolous »

hoolash wrote: post #61
kristopolous wrote: post #25

General form appears to be as follows: http://www.facebook.com/ajax/report/social.php? __a=1& __d=1& attach_additional_photos=1& cid=((FBID))& content_type=0& h=((HASH BASED ON YOUR ACCOUNT))& phase=6& report_id=1& rid=((FBID)) After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy. This issue is probably going to make mainstream news by…

How would this be sent? entering into the address bar returns a blank page, and no change on profile pages.

Sorry just got up ... anyway ... I got it through Firebug and was able to reproduce it in a FireFox Tab, so I assume it was a GET, although it may have been a POST; I didn't cURL the URL from outside the browser though; I'm sure you need cookies.

Re: Facebook security hole allows viewing of private photos

#82

Post by Groxx »

TheCapn wrote: post #29
ianhawes wrote: post #23

This is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?

A security hole is where some attack vector within the code is overlooked (ex: injection attacks, overflows). A negligent feature is one where the steps to exploit the service were put in explicitly. What one does this fall into? At some point a developer coded in a resource that bypasses any privacy data, had it approved by management/coworkers (not sure what model they use) and published it live. I'm certain many p…

Honestly? I'm willing to chock this up to a mistake. A reasonable series of circumstances for this would also be that they missed a single permissions check on an otherwise private-only method. It's probably a single line of code, and one that exists in thousands of other places, surrounded by at least hundreds of other lines of code. An easy thing to overlook.

Re: Facebook security hole allows viewing of private photos

#83

Post by peterhunt »

pasbesoin wrote: post #77
vaksel wrote: post #72

Earlier quoted context omitted.

isn't there another problem with facebook, where none of your photos are ever deleted and can be accessed by the direct url at any time?

I haven't kept up, but IIRC that used to be the case. And that's what I'm addressing. A few years ago, I believe, they explained that they generate these ginormous image caches where, IIRC, individual images are not distinct files. My point is, regardless, if you can find the image (and its extent), and if the cache data are still write-able, then overlay a generated "blank" image onto the cached image, in place. You…

Maybe that was true in the past, but today when you delete your data it is gone. Trust me, I wrote it myself. The law enforcement guidelines that have been circulating recently corroborate this.

Re: Facebook security hole allows viewing of private photos

#84

Post by tptacek »

balsam wrote: post #70
tzury wrote: post #51

someone [1] pulled this trick on Zuck's account [2] 1. http://twitter.com/#!/flyosity/status/144065873743839233 2. http://imgur.com/a/PrLrB

i'd like to see these tagged. (seriously) anybody knows what they are drinking in that last pic? The bottle looks interesting.

Looks like Johnnie Walker Blue.

I'm a little skeezed out at having looked at these photos at all, but "name that liquor" will apparently (in borderline cases like this) trump my principles.

Re: Facebook security hole allows viewing of private photos

#85

Post by noname123 »

kristopolous wrote: post #25

General form appears to be as follows: http://www.facebook.com/ajax/report/social.php? __a=1& __d=1& attach_additional_photos=1& cid=((FBID))& content_type=0& h=((HASH BASED ON YOUR ACCOUNT))& phase=6& report_id=1& rid=((FBID)) After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy. This issue is probably going to make mainstream news by…

I tried to follow this url format by using Chrome Developer toolbar after clicking on "report this photo" of a non-private photo to extract my account hash id, rid and cid of the interested person. It's a GET according to Developer tool.

I get this however,

for (;;);{"__ar":1,"error":1357006,"errorSummary":"Don't have Permission","errorDescription":"You don't have sufficient permissions to do that.","payload":null}

Anyone know if it's already patched?

Re: Facebook security hole allows viewing of private photos

#87

Post by pasbesoin »

peterhunt wrote: post #83
pasbesoin wrote: post #77

Earlier quoted context omitted.

I haven't kept up, but IIRC that used to be the case. And that's what I'm addressing. A few years ago, I believe, they explained that they generate these ginormous image caches where, IIRC, individual images are not distinct files. My point is, regardless, if you can find the image (and its extent), and if the cache data are still write-able, then overlay a generated "blank" image onto the cached image, in place. You…

Maybe that was true in the past, but today when you delete your data it is gone. Trust me, I wrote it myself. The law enforcement guidelines that have been circulating recently corroborate this.

Thank you for the update/clarification.

I deleted a couple of pictures this morning (nothing 'nekkid' ;-) and will have a look to confirm that they are indeed "gone" (inaccessible via direct URL -- albeit the URL of a CDN).

Would you happen to have the identity or URL of a specific guideline that you could point to?

EDIT: I just checked the URL of an image I deleted about an hour and a half ago, and that image is still accessible. It is under akamaihd.net; nonetheless, it is still accessible.

Re: Facebook security hole allows viewing of private photos

#88

Post by alexgartrell »

coverband wrote: post #74
tzury wrote: post #51

someone [1] pulled this trick on Zuck's account [2] 1. http://twitter.com/#!/flyosity/status/144065873743839233 2. http://imgur.com/a/PrLrB

Is he going to kill that poor dog to eat for dinner?

I doubt it https://www.facebook.com/beast.the.dog

Re: Facebook security hole allows viewing of private photos

#89

Post by DougWebb »

Groxx wrote: post #82
TheCapn wrote: post #29

Earlier quoted context omitted.

A security hole is where some attack vector within the code is overlooked (ex: injection attacks, overflows). A negligent feature is one where the steps to exploit the service were put in explicitly. What one does this fall into? At some point a developer coded in a resource that bypasses any privacy data, had it approved by management/coworkers (not sure what model they use) and published it live. I'm certain many p…

Honestly? I'm willing to chock this up to a mistake. A reasonable series of circumstances for this would also be that they missed a single permissions check on an otherwise private-only method. It's probably a single line of code, and one that exists in thousands of other places, surrounded by at least hundreds of other lines of code. An easy thing to overlook.

That's not how security should work. The default should be no-access, so that missing a line of code or making a small mistake leads to too much restriction rather than not enough. That would also help the developer notice the mistake, since the feature wouldn't work.

Re: Facebook security hole allows viewing of private photos

#90

Post by flyosity »

tzury wrote: post #51

someone [1] pulled this trick on Zuck's account [2] 1. http://twitter.com/#!/flyosity/status/144065873743839233 2. http://imgur.com/a/PrLrB

This is a little too meta... I tweeted that (that's me!) but the link to Zuck's photos was found further down in the comments here on HN. That's where I saw it.
Post reply on HN