Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook vulnerability 2013

khalil-sh.blogspot.com

Post reply on HN
Print view View original

11–20 of 301 posts

Re: Facebook vulnerability 2013

#11

Post by stygiansonic »

After watching the video, it looks like the exploit involves:

1) Getting the target user's userId. This used to be part of a user's profile URL but Facebook allowed people to choose a "vanity URL" quite a while ago, so they're no longer as visible. So, instead, the userId is obtained from a FB Graph API query.

2) The form that makes up the "post to newsfeed" has a bunch of hidden inputs. One of them refers to a "xhpc_targetid" and this is probably where the target userId is injected. It's normally set to the current user's id for a default newsfeed post. These values in the DOM are modified during the exploit using something like Chrome Developer Tools on-the-fly and the form is submitted.

If this is truly the case (and I haven't verified it myself) this means that the server side is not really checking permissions and just blindly trusting the client input. Reminded me of this recent (http://arstechnica.com/information-technology/2013/08/how-ea...) article about trusting client input.

Re: Facebook vulnerability 2013

#12

Post by jbroman »

ethanbond wrote: post #8
kbar13 wrote: post #2

Just as your disclosure emails provide almost no information whatsoever, your blog post was also pretty devoid of useful explanation.

> I found an exploit, here's proof, but I'm having difficulty conveying information due to linguistic barriers. > Nope that's not a bug. What did you expect him to do? Learn English on the fly? Conveying specific technical things is a difficult skill to learn even for native English speakers. Sure his communication isn't the best, but neither is "I can't click that link" nor "This isn't a bug."

But it's reasonable to expect him to say something about how it was done. Recording a video is one possible method, and one he's evidently capable of.

Pasting a link to a Facebook profile does not explain the exploit.

Re: Facebook vulnerability 2013

#13

Post by ultrafez »

stygiansonic wrote: post #11

After watching the video, it looks like the exploit involves: 1) Getting the target user's userId. This used to be part of a user's profile URL but Facebook allowed people to choose a "vanity URL" quite a while ago, so they're no longer as visible. So, instead, the userId is obtained from a FB Graph API query. 2) The form that makes up the "post to newsfeed" has a bunch of hidden inputs. One of them refers to a "xhpc…

If that is how it works, then it appears that Facebook have fixed it - you now see the message "message could not be posted to this wall".

Re: Facebook vulnerability 2013

#14

Post by future_grad »

Aqueous wrote: post #6
tshtf wrote: post #5

Note to security response teams everywhere: Not all vulnerability reporters speak perfect English, nor are they all experienced in writing up details on how to exploit issues. It is your responsibility to obtain details from reporters, after the initial report, to avoid situations like this. Facebook should give a bug bounty here, due to their lack of due diligence in following up with the initial responses.

Yeah, what the hell were they doing responding "This is not a bug." without investigating or asking for more details? What the hell is the point of even responding to possible security alerts from the general public if you're not going to investigate?

I am curious to how many trash reports they have to sort through to identify real bug reports. Anyone care to comment?

Re: Facebook vulnerability 2013

#15

Post by danso »

stygiansonic wrote: post #11

After watching the video, it looks like the exploit involves: 1) Getting the target user's userId. This used to be part of a user's profile URL but Facebook allowed people to choose a "vanity URL" quite a while ago, so they're no longer as visible. So, instead, the userId is obtained from a FB Graph API query. 2) The form that makes up the "post to newsfeed" has a bunch of hidden inputs. One of them refers to a "xhpc…

This is a pretty vicious error but common one...it sounds like the analogue to Rails' mass-assignment default protections, which were exploited on Github by tampering with the params via inspector.

Coincidentally, that bug was also exposed by a non-native English speaker who was dismissed for his inability to fluently express himself.

http://homakov.blogspot.com/2012/03/how-to.html

Re: Facebook vulnerability 2013

#17

Post by taspeotis »

future_grad wrote: post #14
Aqueous wrote: post #6

Earlier quoted context omitted.

Yeah, what the hell were they doing responding "This is not a bug." without investigating or asking for more details? What the hell is the point of even responding to possible security alerts from the general public if you're not going to investigate?

I am curious to how many trash reports they have to sort through to identify real bug reports. Anyone care to comment?

Microsoft sifts through bogus security reports all the time. Raymond Chen posts the best-of-the-worst periodically.

Here are I couple I found:

http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247... http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/80801...

Re: Facebook vulnerability 2013

#19

Post by corresation »

Unfortunate situation, but I suspect that the overwhelming majority of HN would have dismissed this out of hand (though it is perfect hindsight to now say they should have worked harder, etc). It reads like minimal-effort ramblings.
Post reply on HN