Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1MM Facebook accounts exposed

google.com

Post reply on HN
Print view View original

161–170 of 181 posts

Re: More than 1MM Facebook accounts exposed

#164

Post by blauwbilgorgel »

Matt_Cutts wrote: post #151

Okay, I've been through all the comments and I'm going to try to summarize: - It looks like in some situations, Facebook will send an email that has a link. That link expires after a certain amount of time, but in the mean time, clicking that link lets people access that Facebook account. - A large number of services can be set up to automatically post any email received onto the web. One major category is disposable…

Automatically posting any email received onto the web can be a security issue. As you said, Blogspot is indiscriminate on which e-mail it publishes, there is no need to suggest a virus is targeting Facebook or Twitter mails -- I was confused on that point.

I've tested the indiscriminate posting and any HTML you send to Blogspot accounts with this feature gets published: Including tags.

An e-mail client isn't supposed to execute tags, I feel if you republish an email online, it should strip out the tags too.

The Blogspot sites that run this service are currently under attack by spammers, who send spam emails (which don't seem to get filtered very well), allowing spam by proxy and editorial-looking links. Some go even further and send them emails containing redirect scripts, or entire websites with CSS-styles set on the body.

  view-source:http://byubjjclub.blogspot.com/search?updated-max=2012-10-23T21:02:00-06:00&max-results=5&start=5&by-date=false
contains such an email-to-webpage post as an example in the source.

  
   
  h1 a:hover {background-color:#888;color:#fff ! important;}                          
  [...]
   
  [...]
  
  [...]
      
   
  [...]
  To stop receiving these emails, you may unsubscribe now.
   Email delivery powered by 
  Google  
  ...
Sending such an e-mail to Blogspot users with this feature, will redirect all their visitors to

  view-source:http://mupara.ru/index.php?pid=19868&subid=31445&psn=131
Custom CSS and custom script allow for attack vectors such as these. Spam doesn't seem to filter very well. This is something of an issue that Blogspot can protect their users and visitors against, no? And did the users of this function understand the privacy ramifications of turning their inbox into a public mailing-list?

Worse than redirects, thinking like a wicked spammer:

  1. User turns on feature inbox-to-webpage
  2. Spammer finds these users by scanning the index
  3. Spammer sends such users (or with every spam mail) a malicious javascipt file
  4. javascript pop-up with: "Re-enter your credentials"
  5. Change password and steal blog
  6. Check if blogspot account is connected to a Gmail account.

Re: More than 1MM Facebook accounts exposed

#165

Post by kevinpet »

lloeki wrote: post #66
tszming wrote: post #55

Common misinterpretation on how Google handle `Disallow` in robots.txt Q. If I block Google from crawling a page using a robots.txt disallow directive, will it disappear from search results? [1] robots.txt Disallow does not guarantee that a page will not appear in results: Google may still decide, based on external information such as incoming links, that it is relevant. If you wish to explicitly block a page from be…

We develop and host a bunch of extranets, which without login consist of your typical authentication page. We put a robots.txt file there, and the only sites that link there are our customers companies home sites. Google still indexes them. The definition of "relevant" here defies my wildest imagination.

robots.txt is not about indexing. It's about crawling.

Re: More than 1MM Facebook accounts exposed

#166

Post by otherbloke »

nico-roddz wrote: post #15
reg29 wrote: post #11

Earlier quoted context omitted.

Strange it doesn't work for me. I get a "Page not found".

Use this Google's query: inurl:bcode=[ ]+n_m=[ ] site:facebook.com

This:

inurl:bcode=[]+n_m=[] site:facebook.com

Goes to some Obama site and redirects to another page. However, using it a second time results in Firefox reporting that it doesn't understand the URL.

Re: More than 1MM Facebook accounts exposed

#167

Post by ack0x06 »

Matt_Cutts wrote: post #155
greggman wrote: post #153

Earlier quoted context omitted.

Sorry but don't believe you about google toolbar. I had a private page with no links in or out and yet it appeared in google search. It was not guessable and there was no chance for a referrer link. The page was never shared with friends nor accessed outside my own computers. I only found out when a friend searched for his name and the page appeared as it was my phone list

Multiple people have run controlled experiments like I described in http://www.mattcutts.com/blog/debunking-toolbar-doesnt-lead-... The most common way such "secret" pages get crawled is that someone visited that secret page with their referrers on and then goes to another page. For example, are you 100% positive that every person who ever visited that page had referrers turned off on every single browser (including…

Are you sure that it is the referrer headers? PP clearly stated there were no outgoing links on the secret page. I think there's a much more mundane explanation: javascript stuff downloaded from Googles CDN. People nowadays are so used to just plopping jQuery etc. into their web pages that they forget that this stuff has to come from somewhere. If it's from Google, I'm quite certain that their CDN loader phones home right before it gives up any of the good stuff.

EDIT: Confirmed, though I was wrong in that there's no loader, requesting jQuery from ajax.googleapis.com gives them a nice fresh Referer header pointing at your secret site for their spiders to crawl. Be mindful!

Re: More than 1MM Facebook accounts exposed

#168

Post by ack0x06 »

franze wrote: post #133
lazyjones wrote: post #77

Earlier quoted context omitted.

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

an old meme, and my usual recommendation: just test it: create a page that i not linked from anywhere. visit it with the browsers mentioned above. watch the logfiles. wait for it. nope, no googlebot request. it is unbelievable easy to test, i have done so on various occasions in the past, so there is no need for you to spread a "several people have reported" rumor. just ... test ... it. as for the old stories, that g…

Don't forget people who may have * installed UserScripts / GreaseMonkey scripts * Browser plugins other than Google Toolbar which may send stuff to the big G * (Self-)modded browsers which send out stuff to wherever...the list goes on and on indeed.

Best thing to do to keep a site secret: * Don't host it on the internet (d'uh) * Hide behind a portal page and have that and your server weed out misconfigured / hijacked browsers before any can proceed to your real secret site (also see web cloaking).

Re: More than 1MM Facebook accounts exposed

#169

Post by [deleted] »

mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

[deleted]

Re: More than 1MM Facebook accounts exposed

#170

Post by acarlucci »

blauwbilgorgel wrote: post #118
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

Since this is already out there as a known issue, and concerns Google too, check out: https://www.google.com/search?q=%22wants+to+be+friends+on+Fa... And you'll find at the time of writing 250.000 more results where the "wants to be friends" email with the auto-login link is posted on blogs. Many of these blogs are also hacked, in that they redirect you to Russian dating sites if you visit the homepage. An example of…

It's something like this (I don't know if you already knew):

1. Try to search this http://goo.gl/dHHsU on Google. You'll find (at the time of writing) 90.300 results.

2. Find an URL like this https://twitter.com/account/confirm_email/[username]/[XXXXX-...

3. Change the URL like this https://twitter.com/account/not_my_account/[username]/[XXXXX...

Twitter "not_my_account" vulnerability:

- Information disclosure vulnerability: you'll see the email of the Twitter user [username]

- DoS vulnerability: you can click on the "I did not sign up for this account" button. After that, the Twitter user [username] email will be removed from the [username] account.

Post reply on HN