mirror to exploit instructions + pictures
http://www.multiupload.com/RC184ELRZ9
Facebook security hole allows viewing of private photos
101–110 of 143 posts
Re: Facebook security hole allows viewing of private photos
#102Earlier quoted context omitted.
Honestly? I'm willing to chock this up to a mistake. A reasonable series of circumstances for this would also be that they missed a single permissions check on an otherwise private-only method. It's probably a single line of code, and one that exists in thousands of other places, surrounded by at least hundreds of other lines of code. An easy thing to overlook.
That's not how security should work. The default should be no-access, so that missing a line of code or making a small mistake leads to too much restriction rather than not enough. That would also help the developer notice the mistake, since the feature wouldn't work.
Agreed, but you'd be hard-pressed to find any site that has that as the standard (much less a social site, with so many inter-weaving connections), that isn't crammed down their throat by laws. Even then it's still hard to get (and keep) it correct 100% of the time, and stands in the way of making changes and new features, which are what keep social sites alive and competitive.
Re: Facebook security hole allows viewing of private photos
#103This was indeed a bug, and shouldn't work any more. We turned off the system that lets you report content through this flow (and thus made this bug's code inaccessible) as soon as we became aware of the issue. In the future, if you find a security / privacy bug on Facebook, feel free to report it via our whitehat program, which will get things looked at more quickly than random blog posts. You can get credit for the…
It's still possible to make the request using:
http://www.facebook.com/ajax/report/social.php?__a=1&__d=1&attach_additional_photos=1&cid=XX&content_type=0&h=YY&phase=6&report_id=1&rid=XX
That said, I'm not sure if it is returning private photos, or just photos that are public - possibly you guys have fixed it on this side, not just the front end having links to it, but figured I'd mention it in case not.
Re: Facebook security hole allows viewing of private photos
#104Earlier quoted context omitted.
I haven't kept up, but IIRC that used to be the case. And that's what I'm addressing. A few years ago, I believe, they explained that they generate these ginormous image caches where, IIRC, individual images are not distinct files. My point is, regardless, if you can find the image (and its extent), and if the cache data are still write-able, then overlay a generated "blank" image onto the cached image, in place. You…
Maybe that was true in the past, but today when you delete your data it is gone. Trust me, I wrote it myself. The law enforcement guidelines that have been circulating recently corroborate this.
Is this true for all data - account details and whatnot? I deleted (not deactivated) my account a few months ago and just assumed everything would remain somewhere in FB's system.
Re: Facebook security hole allows viewing of private photos
#105This was indeed a bug, and shouldn't work any more. We turned off the system that lets you report content through this flow (and thus made this bug's code inaccessible) as soon as we became aware of the issue. In the future, if you find a security / privacy bug on Facebook, feel free to report it via our whitehat program, which will get things looked at more quickly than random blog posts. You can get credit for the…
It is great that you have a page specifically for reporting security issues. For some companies I had to resort to reporting security issues to the main contact address where it landed at some first-level support guy's desk who had no idea what to do and in the end I gave up and the security hole stayed open.
One thing though: Your bounty of $500 is quite low. I bet this whole incident did/does a lot more damage than that. And to be honest, if I had the choice between $500 and trolling Mark Zuckerberg by posting his private photos album online, I would probably chose the latter option (sans the posting a howto on a forum part).
Disclaimer: I am not a security researcher, I don't even look for vulnerabilities. I just sometimes stumble upon bugs and get curious what other side-effects this bug might cause.
Re: Facebook security hole allows viewing of private photos
#106This was indeed a bug, and shouldn't work any more. We turned off the system that lets you report content through this flow (and thus made this bug's code inaccessible) as soon as we became aware of the issue. In the future, if you find a security / privacy bug on Facebook, feel free to report it via our whitehat program, which will get things looked at more quickly than random blog posts. You can get credit for the…
It's still possible to make the request using: http://www.facebook.com/ajax/report/social.php?__a=1&__d=1&attach_additional_photos=1&cid=XX&content_type=0&h=YY&phase=6&report_id=1&rid=XX Where XX and YY can be found by watching the net request made when clicking the initial Report/Block button. That said, I'm not sure if it is returning private photos, or just photos that are public - possibly you guys have fixed it…
Thanks, we'll take a look. In the future you should use https://www.facebook.com/whitehat/ though, as I unfortunately don't catch every HN comment :-).
Re: Facebook security hole allows viewing of private photos
#107Earlier quoted context omitted.
Looks like Johnnie Walker Blue. I'm a little skeezed out at having looked at these photos at all, but "name that liquor" will apparently (in borderline cases like this) trump my principles.
Yep it is, the drink of choice for people who don't want a particularly cheap bottle and pay for label not taste.
Sorry, that's utter bullshit. Blue Label is a perfectly delicious scotch.
Re: Facebook security hole allows viewing of private photos
#108This was indeed a bug, and shouldn't work any more. We turned off the system that lets you report content through this flow (and thus made this bug's code inaccessible) as soon as we became aware of the issue. In the future, if you find a security / privacy bug on Facebook, feel free to report it via our whitehat program, which will get things looked at more quickly than random blog posts. You can get credit for the…
If people submit via that whitehat feature, do you publisize "XY was possible until 20XX-XX-XX"? I consider that important information.
Re: Facebook security hole allows viewing of private photos
#109Earlier quoted context omitted.
Yep it is, the drink of choice for people who don't want a particularly cheap bottle and pay for label not taste.
Sorry, that's utter bullshit. Blue Label is a perfectly delicious scotch.
It's not nasty but it's a drink that's blended to taste reasonably bland, designed for drinking alcohol not designed for enjoying the taste. Its target market is people who don't want anything particularly interesting.
Don't get me wrong, it's much nicer than a £20 bottle of blended stuff, but nowhere near good enough to justify the price tag, and is the huge majority of scotch drinkers (at least a huge majority of those who buy by taste not price) would rate a much cheaper single malt over it, yet alone an equal-costing bottle.
Don't get me wrong, when I get given a bottle I enjoy drinking it, but not as much as the bottles I spend £30-£80 on, yet alone the bottles I spend more on. So that's personal opinion, but it's shared by most people who have drunk and enjoyed a decent range.
Re: Facebook security hole allows viewing of private photos
#110Earlier quoted context omitted.
It's still possible to make the request using: http://www.facebook.com/ajax/report/social.php?__a=1&__d=1&attach_additional_photos=1&cid=XX&content_type=0&h=YY&phase=6&report_id=1&rid=XX Where XX and YY can be found by watching the net request made when clicking the initial Report/Block button. That said, I'm not sure if it is returning private photos, or just photos that are public - possibly you guys have fixed it…
Thanks, we'll take a look. In the future you should use https://www.facebook.com/whitehat/ though, as I unfortunately don't catch every HN comment :-).
Figured there was a good chance you'd already know whether that has been patched and only gives results for non-private photos or not, so seemed a potentially easier option :)