Wait, so how do you escalate this to RCE?
How I found a Remote Code Execution bug affecting Facebook's servers
31–40 of 59 posts
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#32The payment was apparently USD 33'500. Not being in the bug bounty business, I had expected a higher payment.
Not bad for 2 days of work.
The part of the work you don't see is the hours, days and months spent, usually unpaid, spent auditing code to find the bugs.
It is like the anecdote of Tesla and Ford and knowing where to put the X[0], you aren't paying for time or manual labour - bug value is derived from how much damage it can cause, what its worth to Facebook to not be exploited and what the exploit is worth to the bad guys on the black market.
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#33Fb is so stingy with payouts.Bugs of a website with over a billion users can be sold for millions.Is fb ignoring this fact?
People here seem to have a strongly misplaced expectations about what bug bounties pay. Vulnerabilities in web apps/servers tend to be worth less than vulnerabilities in client computers for a few reasons First, web app vulns are usually specific to a single site. (Unless obviously you find an issue in a common underlining framework, say, a session fixation attack in how PHP or ASP.NET handles sessions). Second, and…
Completely agree. To add, IMO the most valuable application of this exploit would have been to deliver drive-by malware. There are some groups that pay $0.5-3 CPM to get their Javascript onto much less targeted web sites. The Yahoo malware would have cost nearly double that.
Getting drive-by traffic is one of the most expensive pieces of the puzzle for malware groups. Last time I checked the forums, a thousand visitors was selling for around a dollar, and that isn't even well qualified traffic.
Having access to Facebook and over a billion pageviews per hour would be worth millions to any group who is capable of handling that type of volume. If they were smart about it, they could probably get away with it for up to a day (the Yahoo malware was active for a day and they didn't obfuscate it much).
Back of the envelope value is around $1M per hour, and that doesn't include the premium for the higher quality of traffic, but does assume you find a way to inject across all the servers and somehow not display it to Facebook internal IPs.
A big group with some fresh browser 0day would have loved to get their hands on this.
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#34Wait, so how do you escalate this to RCE?
Don't think either party has disclosed that.
>and due to a valid scenario he theorized involving an administrative feature we are scheduled to deprecate soon, we decided to re-classify the issue as a potential RCE bug.
I imagine it might be some feature that could maybe be triggered internally through a file:// or http://localhost/ URL, and in doing so gain access to an interface that can issue shell commands. That's pure speculation though, and I'm probably way off.
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#35Earlier quoted context omitted.
People here seem to have a strongly misplaced expectations about what bug bounties pay. Vulnerabilities in web apps/servers tend to be worth less than vulnerabilities in client computers for a few reasons First, web app vulns are usually specific to a single site. (Unless obviously you find an issue in a common underlining framework, say, a session fixation attack in how PHP or ASP.NET handles sessions). Second, and…
Completely agree. To add, IMO the most valuable application of this exploit would have been to deliver drive-by malware. There are some groups that pay $0.5-3 CPM to get their Javascript onto much less targeted web sites. The Yahoo malware would have cost nearly double that. Getting drive-by traffic is one of the most expensive pieces of the puzzle for malware groups. Last time I checked the forums, a thousand visito…
Considering Facebook's good security team (and Yahoo's notoriously poor one), I suspect that they'd probably catch the malware and perform some sort of emergency action in under an hour.
A much more devious attack would be modifying some of the code to silently siphon off login credentials, and grabbing the user database. Then once they were satisfied with that they could go with the malware route.
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#36Just curious. Would you be interested in checking (for a fee ofcourse) other web server products that use similar technology. If so please let me know and I would love to connect with you.
From the article, he says just shoot him an email.
If you find this interesting and want to hire me to do a security
focused review or penetration testing in your own (or your
company's) code, don't hesitate to send me an email at
reginaldo@ubercomp.com.
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#37The payment was apparently USD 33'500. Not being in the bug bounty business, I had expected a higher payment.
A decent amount of cash.
I however believe he could easily have sold it on the black market for more. (Not saying that one should do such a thing.)
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#38Earlier quoted context omitted.
Completely agree. To add, IMO the most valuable application of this exploit would have been to deliver drive-by malware. There are some groups that pay $0.5-3 CPM to get their Javascript onto much less targeted web sites. The Yahoo malware would have cost nearly double that. Getting drive-by traffic is one of the most expensive pieces of the puzzle for malware groups. Last time I checked the forums, a thousand visito…
Considering Facebook's good security team (and Yahoo's notoriously poor one), I suspect that they'd probably catch the malware and perform some sort of emergency action in under an hour. A much more devious attack would be modifying some of the code to silently siphon off login credentials, and grabbing the user database. Then once they were satisfied with that they could go with the malware route.
Facebook must be one of the only large sites that hasn't been hit directly with serving malware, closest I can recall are incidents like this:
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#39So, why is it possible to have XML files reading arbitrary stuff from whatever place again?
XML is data. If your application needs to send a request for reading a file through XML this should really be explicit, not relying in a "permission happy" XML library, no?
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#40Wait, so how do you escalate this to RCE?
I had the same question. After researching a bit, I found that you have multiple wrappers that you can use. One of them is file:// another is php://. I wonder if the php:// one is available in HipHop.