Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deleting any Facebook album

7xter.com

Post reply on HN
Print view View original

91–100 of 107 posts

Re: Deleting any Facebook album

#91

Post by Orangeair »

dsacco wrote: post #56
darrhiggs wrote: post #49

So here seems like as good a thread as any. What do you do when you think a company would just fix the bug based on your report and not pay out anything? I have seen so many bugs in the wild like this. For example a site in the uk where I can get access to any account I wish. Are there any data protection laws that would provide leverage? How would you make first contact with a company that doesn't advertise a bug bo…

No, that email doesn't seem okay at all. That's extortion. A company has every right to not offer a bug bounty, and to fully prosecute you for trying to find a vulnerability (you can quibble about what "trying to find a vulnerability" means, but they have the right, like it or not). You have no right to demand payment for a perceived vulnerability in a company's infrastructure, even if they have a bug bounty program.…

> "And if you do this, you don't seek payment, you do it because you're a professional security researcher who cares about their security, not because you're trying to make a quick buck."

What if you aren't a professional security researcher, though? I'm sure there are plenty of underpaid people out there who stumble onto bugs like this every so often. Yes, asking the company to give you money on threat of revealing the bug is definitely extortion, but you are assuming a little too much in this case I believe. Some people may truly need the money.

Re: Deleting any Facebook album

#92

Post by wodenokoto »

monochromatic wrote: post #81
drubio wrote: post #76

Didn't anyone else find this post suspicious ? I browsed through the site thinking there were some other interesting security posts. Turns out this is the only post on the site. Then I did a Whois and this site was created 2 days ago. It's registered to laksshmanan51@gmail.com which is apparently the same guy on the post. Then I did a search on Google for laksshmanan51@gmail.com and there are search results with "You…

Also, the guy who found this vulnerability doesn't know not to use jpegs for text?? That doesn't pass the smell test either.

Those are two completely different skill sets. one is knowledge of vulnerabilities and security, the other is about good web practices. There is no overlap in skill set here.

Re: Deleting any Facebook album

#93

Post by ch0wn »

xienze wrote: post #23

Is anyone else kind of shocked that this particular vulnerability exists given that Facebook employs "the best and brightest" in the industry? This isn't one of those vulnerabilities that relies on numerous seemingly unrelated steps and makes you wonder how the person ever thought it up. Instead, this is security 101 stuff. Facebook simply wasn't making sure userFor(appKey) == owner(albumId). I would've assumed obvio…

That is not how a scalable architecture looks like. You don't want to handle authorization in the same service that's responsible for deleting the resource. Yes, there should have been tests in place, but no it's not a missing if condition.

Re: Deleting any Facebook album

#94

Post by MichaelGG »

ryanburk wrote: post #77
MichaelGG wrote: post #74

Earlier quoted context omitted.

I'm just trying to let FB know of a potential phishing attempt that's targeting all Windows users. I don't care about the bounty, in fact I only care a: to teach MS a lesson and b: to annoy the "developers" scamming people. I don't care enough to sign up for FB. Every other company I've dealt with on this, except some of the large media companies, have been easy enough to contact about the problem. To be clear, the i…

things might have changed over the past 12 months, but if you report an app from the store app in windows 8, the report gets looked at and they were good about removing apps that had issues. I say this since I went through this process myself about a year ago and the app I reported was taken down. full disclosure: I worked on the app store team, but didn't use any internal mechanism.

I've been going through this recently quite a bit. Reporting stuff is a waste of time, except for entertainment purposes.

I've reported all sorts of things. In nearly every single case, they say they cannot do anything. Even when there's a fake DropBox app "by" "@Microsoft". In that case, the CSR told me to try re-installing the app, that it worked for him. Zero understanding of the issue.

I've found a fake Windows Update on the Store. Reporting it got a generic response, until I emailed the MS security folks. Then it was removed in a few minutes. Meanwhile, they suggest I "Leave a review" or email the developer. Idiotic.

Netflix went back and forth with MS at least 3 times. Amazon had issues as well. Other ISVs tell me they can simply not get MS to be responsive about things.

Disney was the funniest response. Despite being a major Store publisher, there's all sorts of fake Disney stuff online. When I spoke to the Disney Store about it, the final suggestion was "don't go on it [the Windows Store]". Neato.

It's obvious MS is just padding the app numbers and no review is actually happening. It's a shame, since it undermines all the work; the Windows Store is a joke even with casual users. (Like even meeting random people on a plane and asking.) I emailed Satya. I emailed the GM of the Store. I emailed the Dev evangelist pushing the "let's pay people in third world countries 4 months salary for publishing 20 shitty wrap-a-webpage apps" program. No replies.

Here's a gallery of some gems: http://imgur.com/a/xvqZg#0

But nothing beats this awesomeness: http://imgur.com/fLOWMI4

I really hope they enable an Android compat layer. Even if it's slow, A: tons of random utility apps will be available, B: MS can enforce some quality instead of quantity.

I find it hard to believe MS isn't aware of these issues, unless no one actually uses it (Win10 makes it more in-your-face, though). Someone must have a bonus that's tied to "published app count". Neither Apple nor Google have these issues. The Store is worse than the Android Marketplace was.

Re: Deleting any Facebook album

#97

Post by Fargren »

Orangeair wrote: post #91
dsacco wrote: post #56

Earlier quoted context omitted.

No, that email doesn't seem okay at all. That's extortion. A company has every right to not offer a bug bounty, and to fully prosecute you for trying to find a vulnerability (you can quibble about what "trying to find a vulnerability" means, but they have the right, like it or not). You have no right to demand payment for a perceived vulnerability in a company's infrastructure, even if they have a bug bounty program.…

> "And if you do this, you don't seek payment, you do it because you're a professional security researcher who cares about their security, not because you're trying to make a quick buck." What if you aren't a professional security researcher, though? I'm sure there are plenty of underpaid people out there who stumble onto bugs like this every so often. Yes, asking the company to give you money on threat of revealing…

Needing money is not in our current economic system enough cause to get it. If we are accepting the premise than extorting people this way is illegal and unethical, it doesn't become more legal because you are poor or not a professional, and probably not more ethical either.

Re: Deleting any Facebook album

#98

Post by [deleted] »

duncans wrote: post #73
xienze wrote: post #23

Is anyone else kind of shocked that this particular vulnerability exists given that Facebook employs "the best and brightest" in the industry? This isn't one of those vulnerabilities that relies on numerous seemingly unrelated steps and makes you wonder how the person ever thought it up. Instead, this is security 101 stuff. Facebook simply wasn't making sure userFor(appKey) == owner(albumId). I would've assumed obvio…

Mistakes happen. When you're pen-tested for the first time (by a decent pen-tester) you go through the 5 Stages of Grief with the stuff they find.

[deleted]

Re: Deleting any Facebook album

#99

Post by ponyous »

ch0wn wrote: post #93
xienze wrote: post #23

Is anyone else kind of shocked that this particular vulnerability exists given that Facebook employs "the best and brightest" in the industry? This isn't one of those vulnerabilities that relies on numerous seemingly unrelated steps and makes you wonder how the person ever thought it up. Instead, this is security 101 stuff. Facebook simply wasn't making sure userFor(appKey) == owner(albumId). I would've assumed obvio…

That is not how a scalable architecture looks like. You don't want to handle authorization in the same service that's responsible for deleting the resource. Yes, there should have been tests in place, but no it's not a missing if condition.

Can you elaborate?

Re: Deleting any Facebook album

#100

Post by Raphmedia »

itsybitsycoder wrote: post #86
Raphmedia wrote: post #41

Earlier quoted context omitted.

No, but imagine the ressources they would have had to throw at the problem if the user had instead decided to delete ALL the photo albums on the site. Or imagine if he would have used the exploit to delete all the photos of a movie launch, etc. The reward is appropriate.

I'm guessing not much? I was under the impression that nothing you delete on Facebook is ever truly deleted, just marked as disabled and hidden. And if they're logging their API calls it should be fairly straightforward to look up which albums were disabled using that one token and switch the flag back.

Not from this point of view, but from a marketing point of view, deleting photos is quite a power. Imagine being able to ruin a movie's launch while your own movie is all over youtube.
Post reply on HN