Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1MM Facebook accounts exposed

google.com

Post reply on HN
Print view View original

131–140 of 181 posts

Re: More than 1MM Facebook accounts exposed

#131

Post by nico-roddz »

dhimes wrote: post #115
nico-roddz wrote: post #53

Earlier quoted context omitted.

This is how everything started: A friend forward me an email from a FB group notification Something like: http://www.facebook.com/n/?groups%[id here]%2Fpermalink%[id here]%2F&mid=[id here]&bcode=[id here]-mjoi&n_m=[email adress here] When I clicked the url I got automatically logged into my friend's account. So is definitely a Facebook security issue. Then I tried some google searches to see if I could find some urls…

Thanks for catching this nico-- looks like it's been removed from Google.

You're welcome!

Re: More than 1MM Facebook accounts exposed

#132

Post by Evbn »

gcorne wrote: post #127
credo wrote: post #85

Earlier quoted context omitted.

You mention that the nonces expire after a period of time. If you don't plan on cutting the feature for ever, perhaps you could consider an alternative approach of limiting the validity of the URLs to the first visit and also removing the email-id (and other PII data) of the user from the URL.

When did the term "nonce" start being used in web application development to refer to a token that expires after a period of time instead of being a true one-time use number/token? http://en.wikipedia.org/wiki/Cryptographic_nonce

Nonces are one time use in webapps, unless bad bug.

Re: More than 1MM Facebook accounts exposed

#133

Post by franze »

lazyjones wrote: post #77
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

an old meme, and my usual recommendation: just test it: create a page that i not linked from anywhere. visit it with the browsers mentioned above. watch the logfiles. wait for it. nope, no googlebot request. it is unbelievable easy to test, i have done so on various occasions in the past, so there is no need for you to spread a "several people have reported" rumor. just ... test ... it.

as for the old stories, that google does this kind of thing: people, especially SEOs or people who think they know SEO, always blame google. oh, my beta.site has been indexed, it must be because of ... google is evil.

most of the times i have seen cases where googlebot found a not published yet site it was because of (just some examples, not a complete list) i.e.:

* turned on error reporting (most of the PHP sites) * the URLs were already used in some javascript * server side analytics software, open to the public * apaches shows file/order structure * indexable logfiles * people linked to the site * somebody tweeted about it * site was covered on techcrunch (yes, really) * all visited URLs in the network were tracked by a firewall, the firewall published a log on an internal server, the internal server was reachable from the outside * internal wiki is indexable * intranet is indexable * concept paper is indexable

testing your hypothesis "chrome/google toolbar/... push URLs into the googlebot discovery queue, which leads to googlebot visits" is easily testable. no need to spread rumors. setup for testing this: make an html-page (30 seconds max, basically ssh to your server, create a file, write some html), tail & grep logfiles (30 sec max), wait (forever)

Re: More than 1MM Facebook accounts exposed

#134

Post by Evbn »

macchina wrote: post #41
jpadvo wrote: post #24

Here's one theory and analysis of what might have happened. Some people's emails got out into the public internet, and were indexed. Some of these emails were from Facebook, and included links to resources that require login. These links pre-populated the username field for convenience, or in some cases auto-login the user. Facebook's engineers probably did not anticipate email notifications to users being crawled by…

I clicked on some profiles, and I noticed that many of the e-mail addresses populated were @asdasd.ru — the domain of a Russian mailinator-type service. Something like that might be indexed.

Huh, I wonder now if account hijacking is the actual design purpose of mailinators.

Re: More than 1MM Facebook accounts exposed

#135

Post by engtech »

eli wrote: post #114
nico-roddz wrote: post #88

Earlier quoted context omitted.

Thanks Matt, My only concern is my account security (not money). I found this issue with almost no technical knowledge, so the crazy thing is: How many back doors should be over there ready to be exploited by spammers? BTW, a big "report security issue" button on https://www.facebook.com/help/ would certainly help next time. Thanks again, Nico

It shouldn't take you more than one Google query to find the place to report Facebook security problems. I don't think it's a good idea to link it from the general support section -- you don't want the security team that is hopefully carefully monitoring this stuff to have to wade through thousands of regular customer service complaints.

It shouldn't... but it could be easier. I've been in the situation before where I wanted to report malware on facebook and I couldn't figure out where to report it.

I agree that you don't want reporting a security issue to supersede the general case of problems, but as things stand it is hard to figure out how to report a real security issue if you don't know about that magic whitehat url.

Googling "facebook security" brings

#1 result: https://www.facebook.com/security

no information on reporting problems there

#2 result: https://www.facebook.com/help/security

this one has a Report Something link... but that doesn't give you options for reporting a security issue, just TOS violations or copyright infringement.

#3 result: https://www.facebook.com/security/app_10442206389

This looks better than the other two, but there is still nothing here about how to report a security issue.

Knowing what to look for, there's a hidden "Take Action >> White Hats" link that will eventually take you to the correct page: https://www.facebook.com/security/app_6009294086

So click that link... and presented with a huge page of names and still no obvious call to action: https://www.facebook.com/whitehat

Oh, it's the Report Vulnerability link in that sidebar that we're been conditioned to ignore in the normal Facebook UI.

https://www.facebook.com/whitehat/report/

---

Just to recap, in order to find how to submit a security bug report, it took me 15 minutes and I still only found it because I knew the term to look for was "white hat" and not "security".

Re: More than 1MM Facebook accounts exposed

#136

Post by mandeepj »

lazyjones wrote: post #77
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

Whether google sends the urls to itself or not can be easily decided by using a http monitoring tool like fiddler and with hosts filter we can narrow down the traffic to google.com

Leave it running for few days you will see for yourself

Re: More than 1MM Facebook accounts exposed

#137

Post by mibbitier »

mh- wrote: post #116
mibbitier wrote: post #91

Earlier quoted context omitted.

huh? Infrastructure is totally and utterly irrelevant to the problem. I know enough about common sense to make such a claim. Just send a new message, exactly as you would post an original item/comment/etc, but have some special text/field in there that says "please ignore the previous message". The UI would then hide the previous message. eg COMMENT: {id:9374758, from:"mibbitier", data:"I hate you all!"} COMMENT: {id…

I'm sure it's already rendered to a static presentation-level (HTML/template language du jour) form at that point. That wouldn't work.

Just put some more javascript in there to deal with it. I'm sure it's not the hardest problem in the world.

Re: More than 1MM Facebook accounts exposed

#138

Post by blauwbilgorgel »

franze wrote: post #133
lazyjones wrote: post #77

Earlier quoted context omitted.

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

an old meme, and my usual recommendation: just test it: create a page that i not linked from anywhere. visit it with the browsers mentioned above. watch the logfiles. wait for it. nope, no googlebot request. it is unbelievable easy to test, i have done so on various occasions in the past, so there is no need for you to spread a "several people have reported" rumor. just ... test ... it. as for the old stories, that g…

It is a myth that is hard to get rid of. No one wants to admit they tweeted out a link to the dev website.

Though I recently found this on the Google+ FAQ: http://support.google.com/webmasters/bin/answer.py?hl=en&#38...

  When you add the +1 button to a page, Google assumes that
  you want that page to be publicly available and visible in
  Google Search results. As a result, we may fetch and show
  that page even if it is disallowed in robots.txt.
I can understand adding a +1 button to a dev site, and then not understanding why it shows up in the index.

Re: More than 1MM Facebook accounts exposed

#139

Post by gcorne »

Evbn wrote: post #132
gcorne wrote: post #127

Earlier quoted context omitted.

When did the term "nonce" start being used in web application development to refer to a token that expires after a period of time instead of being a true one-time use number/token? http://en.wikipedia.org/wiki/Cryptographic_nonce

Nonces are one time use in webapps, unless bad bug.

WordPress uses them in a similar way to how it sounds like Facebook is using them. I wonder how many others are misusing the term.
Post reply on HN