Facebook security hole allows viewing of private photos • Hacker News Board

Re: Facebook security hole allows viewing of private photos

#21

Post by funkeemonk » Tue, Dec 06, 2011, 1:21 PM UTC

jerfelix wrote: post #9

citricsquid wrote: post #8

It would seem based on the screenshot ("Message x to ask them to remove the photo...") that they must have specific permissions set to cause this to work as I can't replicate on people that I can't message.

I disagree. You can message people that you aren't friends with. See the first screen shot ("add her as a friend or send her a message"). I think the reason it only works on some profiles it that perhaps the profile pictures are the only ones that it will show you. And some people only have one profile photo. (This is an untested theory / guess.)

Tested this theory against my account using another throwaway one. My real account has several profile pictures and the exploit didn't work.

Re: Facebook security hole allows viewing of private photos

#22

Post by vineetdhanawat » Tue, Dec 06, 2011, 1:24 PM UTC

DrinkWater wrote: post #2

Seems to be already fixed. The last option described in this tutorial is not there anylonger.

It still working for me. Tested few minutes back. I tried this on different proxies as well, so it cannot be region specific.

Maybe they are rolling it out (lets say blocking it out) slowly now.

Re: Facebook security hole allows viewing of private photos

#23

Post by ianhawes » Tue, Dec 06, 2011, 1:27 PM UTC

This is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?

Re: Facebook security hole allows viewing of private photos

#24

Post by Archio » Tue, Dec 06, 2011, 1:31 PM UTC

ianhawes wrote: post #23

This is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?

I think it's a stretch to call this "just" a mistake. First of all, there isn't any malicious code that has to be run to execute it, it's a simple as clicking a few buttons in the UI.

Secondly, Facebook is a site with hundreds of millions of users managing billions of private photos. With the amount of revenue & number of developers they have, it's inexcusable that they can't think through a simple process like this without considering what happens if two users aren't friends.

Granted, they're probably not "trying" to undermine privacy. But they're doing a very poor job at maintaining it.

Re: Facebook security hole allows viewing of private photos

#25

Post by kristopolous » Tue, Dec 06, 2011, 1:37 PM UTC

General form appears to be as follows:

    http://www.facebook.com/ajax/report/social.php?
     __a=1&
     __d=1&
     attach_additional_photos=1&
     cid=((FBID))&
     content_type=0&
     h=((HASH BASED ON YOUR ACCOUNT))&
     phase=6&
     report_id=1&
     rid=((FBID))

After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy.

This issue is probably going to make mainstream news by noon.

Re: Facebook security hole allows viewing of private photos

#26

Post by rplnt » Tue, Dec 06, 2011, 1:41 PM UTC

judofyr wrote: post #18

tectonic wrote: post #13

Earlier quoted context omitted.

Or privacy. The assumption here is that if someone thinks you have an inappropriate photo, you now have no right to privacy?

I doubt that's way this happened. More likely, the person who implemented the "inappropriate photo"-feature wasn't fully aware of that the "Report"-functionally was enabled for everyone and not just your friends. However, someone had to implement the backend for listing out those photos, and they clearly didn't think of access control, so there's at least something fishy here…

It's not the first time either. Very similar breach of privacy happened when they implemented "view my profile as ..." functionality. You gained access to the private data of the user you were simulating.

Re: Facebook security hole allows viewing of private photos

#27

Post by djbender » Tue, Dec 06, 2011, 1:41 PM UTC

still works.

Re: Facebook security hole allows viewing of private photos

#28

Post by hannibalhorn » Tue, Dec 06, 2011, 1:43 PM UTC

Funny how something like this is originally posted on a body building forum. I think the first reports of the recent Penn State scandal were posted there too (around a year ago.) Who would have thought that's where you'd first find such things?

Re: Facebook security hole allows viewing of private photos

#29

Post by TheCapn » Tue, Dec 06, 2011, 1:46 PM UTC

ianhawes wrote: post #23

This is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?

A security hole is where some attack vector within the code is overlooked (ex: injection attacks, overflows). A negligent feature is one where the steps to exploit the service were put in explicitly.

What one does this fall into?

At some point a developer coded in a resource that bypasses any privacy data, had it approved by management/coworkers (not sure what model they use) and published it live. I'm certain many people have been exploiting this longer than that forum post existed.

Re: Facebook security hole allows viewing of private photos

#30

Post by rmc » Tue, Dec 06, 2011, 1:49 PM UTC

ianhawes wrote: post #23

This is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?

I think people know that this is a mistake. But it shouldn't have happened. Facebook is a massive, wealthy company that has many many programmers. Bugs like this should not have happened, considering that privacy is one of the biggest media problems Facebook has.