Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Delete any Photo from Facebook by Exploiting Support Dashboard

arulxtronix.blogspot.in

Post reply on HN
Print view View original

21–30 of 32 posts

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#21

Post by codesuela »

terabytest wrote: post #14
meatsock wrote: post #7

wow that's a nice bounty for changing two parameters on the end of a URL.

The exploit is easy, but the implications are very dangerous. Such an exploit could have been automated to take down hundreds of photos before it was even detected.

nope, only thing this would've shown is that pictures aren't really deleted. Think about it. Facebook would do a rollback and all the pictures would be back. However with a little bad luck on their part they'd mess up which would lead to them restoring rightfully deleted pictures (many of them embarrassing). Would this have happened for sure? Probably not, but I strongly believe that this could have ended hilariously and frankly I am a little disappointed that the researcher was a white hat ;)

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#22

Post by vinceguidry »

codesuela wrote: post #21
terabytest wrote: post #14

Earlier quoted context omitted.

The exploit is easy, but the implications are very dangerous. Such an exploit could have been automated to take down hundreds of photos before it was even detected.

nope, only thing this would've shown is that pictures aren't really deleted. Think about it. Facebook would do a rollback and all the pictures would be back. However with a little bad luck on their part they'd mess up which would lead to them restoring rightfully deleted pictures (many of them embarrassing). Would this have happened for sure? Probably not, but I strongly believe that this could have ended hilariously…

Rolling back is a last-ditch effort, it often causes more problems than it would cure. Sure you'd get the pictures back, but everything done in the interrim would be deleted. And if he were a black hat, we'd have never heard about this.

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#23

Post by pearjuice »

Is it still worth it to follow every link on Facebook and check the URLs/AJAX requests whether the parameters can be tampered with? At Facebook's scale I always assumed there would be someone full-time employed to do this. In fact, I wouldn't mind if it was good paying. Just give me all the Facebook frontend endpoints and I will go by them one-by-one. Manually. I will even document the test cases and what could be intercepted, changed or can be improved in terms of validation.

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#24

Post by Buge »

kristofferR wrote: post #3

This guy was lucky to be proficient enough in English to recieve the bounty, unlike this guy: http://www.theverge.com/2013/8/18/4633046/facebook-security-...

The problem with that guy is that he didn't use a test account and tested it on a random girl without her permission.

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#25

Post by GuiA »

pearjuice wrote: post #23

Is it still worth it to follow every link on Facebook and check the URLs/AJAX requests whether the parameters can be tampered with? At Facebook's scale I always assumed there would be someone full-time employed to do this. In fact, I wouldn't mind if it was good paying. Just give me all the Facebook frontend endpoints and I will go by them one-by-one. Manually. I will even document the test cases and what could be in…

Two people have done it publicly and successfully over the past month or so, so yeah, I would argue that it might be worth it.

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#26

Post by sp332 »

Argorak wrote: post #4
kristofferR wrote: post #3

This guy was lucky to be proficient enough in English to recieve the bounty, unlike this guy: http://www.theverge.com/2013/8/18/4633046/facebook-security-...

He might even get into Y combinator, if he tried. There, I did it. Haha. Can we stop beating dead horses, we all read Hacker News around here?

That was a dig at Facebook, not pg or YC.

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#27

Post by MichaelApproved »

vinceguidry wrote: post #22
codesuela wrote: post #21

Earlier quoted context omitted.

nope, only thing this would've shown is that pictures aren't really deleted. Think about it. Facebook would do a rollback and all the pictures would be back. However with a little bad luck on their part they'd mess up which would lead to them restoring rightfully deleted pictures (many of them embarrassing). Would this have happened for sure? Probably not, but I strongly believe that this could have ended hilariously…

Rolling back is a last-ditch effort, it often causes more problems than it would cure. Sure you'd get the pictures back, but everything done in the interrim would be deleted. And if he were a black hat, we'd have never heard about this.

I can't imagine Facebook could roll anything back on their scale. Everything touches so many things, it would be a nightmare to get done.

I'd imagine they'd find the accounts that were responsible for deleting the pictures that weren't theirs (as this hack allowed to have happen) and restore the pictures deleted by those accounts.

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#28

Post by MichaelApproved »

Robin_Message wrote: post #10
ffk wrote: post #6

Earlier quoted context omitted.

They most likely do test for security vulnerabilities. However, the attack surface and overall complexity is so large that things will slip by even with the most rigorous testing. For now, the best you can hope for is a layered defense and rigorous dev and ops practices to help minimize the attack surface and reduce the overall damage a single successful attack can achieve.

Putting the user id in the request is obviously wrong, since the owner can looked up from the photo id. Automated testing/fuzzing could find this, but probably better training/practices would be easier to get right and save time/money in the long run.

Exactly. As little as possible should be passing through the querystring. Put in the minimum amount in the QS and look the rest up in the DB. If possible, the QS should be signed for an extra layer of protection.

Re: Delete any Photo from Facebook by Exploiting Support Dashboard

#30

Post by Argorak »

sp332 wrote: post #26
Argorak wrote: post #4

Earlier quoted context omitted.

He might even get into Y combinator, if he tried. There, I did it. Haha. Can we stop beating dead horses, we all read Hacker News around here?

That was a dig at Facebook, not pg or YC.

That was a complaint about the style of posting, not about pg, YC or Facebook.
Post reply on HN