11–20 of 32 posts
As I understand it, the exploit involves crafting a URL to send in a removal request to the Facebook support. Wouldn't this count as social engineering or were the removal requests automated? Regardless, well done!
Facebook should make a "Hack Me" profile for people to mess with, so they don't have to use Zuckerberg's instead.
wow that's a nice bounty for changing two parameters on the end of a URL.
As I understand it, the exploit involves crafting a URL to send in a removal request to the Facebook support. Wouldn't this count as social engineering or were the removal requests automated? Regardless, well done!
Facebook should make a "Hack Me" profile for people to mess with, so they don't have to use Zuckerberg's instead.
https://www.facebook.com/whitehat/accounts/
Earlier quoted context omitted.
https://www.facebook.com/whitehat/accounts/
That just gives out the same info as https://www.facebook.com/whitehat/ , unless (I speculate) you already have a Facebook account and are logged in.
This guy was lucky to be proficient enough in English to recieve the bounty, unlike this guy: http://www.theverge.com/2013/8/18/4633046/facebook-security-...
Earlier quoted context omitted.
They most likely do test for security vulnerabilities. However, the attack surface and overall complexity is so large that things will slip by even with the most rigorous testing. For now, the best you can hope for is a layered defense and rigorous dev and ops practices to help minimize the attack surface and reduce the overall damage a single successful attack can achieve.
Putting the user id in the request is obviously wrong, since the owner can looked up from the photo id. Automated testing/fuzzing could find this, but probably better training/practices would be easier to get right and save time/money in the long run.
While Facebook most likely does do some form of threat modeling for their main site, without a rigid process for all code that goes public you'll run into issues like this that are just as severe. Just because it's a mobile support site for requesting photo removals doesn't mean it is less important surface area in terms of security.
