Remote Code Execution on a Facebook server

Post by zenmaster10665 » Fri, Aug 24, 2018, 10:28 PM UTC

gandreani wrote: post #6

Nice job! I also really appreciate the lack of memes and very concise format of this blog post

Post by shoo » Fri, Aug 24, 2018, 10:37 PM UTC

GordonS wrote: post #136

tptacek wrote: post #55

Earlier quoted context omitted.

Of course. You can lock the process down so that it can't make unexpected system calls. If you deploy in a modern container environment, you can also use container networking to drastically limit what the application environment can talk to on the network. Though it's a less potent mitigation than seccomp and container isolation (and one you get for free once you deploy in a container), you can also limit filesystem…

> You can lock the process down so that it can't make unexpected system calls Huh, this isn't something I've ever come across before. Off the top of my head, I guess it would be possible on Windows using a kernel mode driver, but that's pretty hardcore, and really easy to get wrong. I know you can easily audit syscalls on Linux with auditd, but haven't seen preventing them before. Is this an option on both Linux and…

Post by js2 » Fri, Aug 24, 2018, 11:03 PM UTC

collinmanderson wrote: post #147

matharmin wrote: post #83

This is why you (looking at frameworks) should never use a format that may contain code to store data, especially when the client has control over that data (even if signed). The same vulnerability has occurred in almost every language/framework that does this, including Rails and Java-based ones. Just use something like JSON, which completely avoids code execution vulnerabilities like this. Except of course for the…

Yes, Django realized this 7 years ago [0], and JSON has been the default for the past 5 years[1], it's just that facebook was using an old version of Django, and probably not the default. [0] https://groups.google.com/d/msg/django-developers/YwlZ9m9k1b... [1] https://github.com/django/django/commit/b0ce6fe656873825271b...

Post by arcticfox » Fri, Aug 24, 2018, 11:18 PM UTC

tptacek wrote: post #137

meowface wrote: post #90

Earlier quoted context omitted.

I agree he deserves a higher payout, but it was on a segmented server that seems like it didn't have any customer data or other important data. If he were a real attacker, who knows where else he could've pivoted from this server (perhaps it wasn't quite as segmented as Facebook thought). But assuming it truly was pretty isolated, compromising it probably wouldn't have caused any damage. Regardless, I feel like he de…

Where are you pulling that number out of?

Post by tedunangst » Sat, Aug 25, 2018, 12:36 AM UTC

meowface wrote: post #161

tptacek wrote: post #137

Earlier quoted context omitted.

Where are you pulling that number out of?

Honestly, just a gut feeling. (So, my ass.) I just feel like RCE should warrant somewhere around that much by default, even if the overall impact isn't high in a particular case. Some combination of potential impact and nature of the vulnerability/exposure should go into reward calculations, in my opinion.