Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I found a Remote Code Execution bug affecting Facebook's servers

ubercomp.com

Post reply on HN
Print view View original

51–59 of 59 posts

Re: How I found a Remote Code Execution bug affecting Facebook's servers

#51

Post by raverbashing »

billyhoffman wrote: post #45
raverbashing wrote: post #39

So, why is it possible to have XML files reading arbitrary stuff from whatever place again? XML is data . If your application needs to send a request for reading a file through XML this should really be explicit, not relying in a "permission happy" XML library, no?

Yes, XML is data, but it allows you to specify where other data is located that should be included when processing it. These links can be to addition data, or to definitions of how to process the data in the document (XML entities). It's a simplification, but it's as if XML can have #includes, where the source of the #include is a URL, and can even be a file:/// URL. So the attack looks like this: Server takes input…

Sure it makes sense, what doesn't make sense is the library reading anything it is thrown at it.

I'm thinking there should be a "root path" for the library to be able to access files. Sure, you want to include "base.xml" it's in a specific directory and the library is allowed to read only that, and no "../../../../etc/password" tricks.

Re: How I found a Remote Code Execution bug affecting Facebook's servers

#52

Post by reginaldo »

epmatsw wrote: post #48
nikcub wrote: post #32

Earlier quoted context omitted.

The part of the work you don't see is the hours, days and months spent, usually unpaid, spent auditing code to find the bugs. It is like the anecdote of Tesla and Ford and knowing where to put the X[0], you aren't paying for time or manual labour - bug value is derived from how much damage it can cause, what its worth to Facebook to not be exploited and what the exploit is worth to the bad guys on the black market. […

He says that it took him about 2 days total https://news.ycombinator.com/item?id=7106482

The 10 years before those 2 days helped a lot too...

Re: How I found a Remote Code Execution bug affecting Facebook's servers

#54

Post by cji »

D3_4dl1N3 wrote: post #53

Very interesting, but there is a good chance that other people have stumbled upon, but they preferred to wear a black hat. Anyway, hats off.

from the FB post "In parallel, other members of the Security team investigated the logs corresponding to this issue and confirmed that it had not been previously exploited or used maliciously."

Re: How I found a Remote Code Execution bug affecting Facebook's servers

#55

Post by markshepard »

hundchenkatze wrote: post #36
markshepard wrote: post #15

Just curious. Would you be interested in checking (for a fee ofcourse) other web server products that use similar technology. If so please let me know and I would love to connect with you.

From the article, he says just shoot him an email. If you find this interesting and want to hire me to do a security focused review or penetration testing in your own (or your company's) code, don't hesitate to send me an email at reginaldo@ubercomp.com. *edit: formatting

Thanks. I had not noticed it. I will definitely ping him!

Re: How I found a Remote Code Execution bug affecting Facebook's servers

#56

Post by zobzu »

A lot of people think its not enough money. In this case it appears to be about 30K USD.

Here's an issue with paying more: the security engineers employes are paid around 100 to 150K a year.

Imagine you'd get paid 100K for a big exploit. It wont be valuable to be a security engineer anymore (since you can't be paid additionally for finding the bugs), it's better to be unemployed and spend your time finding the bugs.

I think that's one of the main issue, at least until bugs are extremely, extremely rare (which really, they aren't - these news are really the tip of the iceberg).

Re: How I found a Remote Code Execution bug affecting Facebook's servers

#57

Post by zobzu »

meshko wrote: post #31

Wait, so how do you escalate this to RCE?

once you've fs access, it's rarely extremely hard, unless the systems are very well protected from within (such as with RBAC and what-not).

They never protect the systems from within that well because generally it's more effort than it's worth (well, of course, the day a company becomes bankrupt because of an RCE, they'd wish they spent the time - as usual with security).

Of course, it doesn't mean it's always possible. It's just likely.

Random scenario, since /etc/passwd is available, it tells me the php config sucks. you could just write a php shell and run it on the web interface. Or have the code within requests and read the log file (again, its all about config. if php let you read the file and doesn't only execute for .php files, bang. or if you can write a .php, bang again.)

The point really is that I rarely see people caring about protecting anything or following best practices once someone found a bug that affects the system (such as fs access).

Re: How I found a Remote Code Execution bug affecting Facebook's servers

#59

Post by chmars »

skittles wrote: post #49
hueving wrote: post #24

Earlier quoted context omitted.

Not bad for 2 days of work.

So would you rather pay a master $33,500 for 2 days of work or a novice $33,500 for a year of work (and possibly no results)?

You pay for results, not for time. And you can use an existing market to define a price.

Time is often used to measure compensation – lawyers are well known for being paid in hourly fees –, however, in the long run, only results counts. And concerning the market, for how much could this bug have been sold, for example to the NSA?

Post reply on HN