Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on a Facebook server

blog.scrt.ch

Post reply on HN
Print view View original

201–207 of 207 posts

Re: Remote Code Execution on a Facebook server

#201

Post by nijave »

smsm42 wrote: post #142
TheDong wrote: post #140

Earlier quoted context omitted.

Note that 5 is true though. Using a secret to sign or encrypt a cookie does normally work, and it's a common practice. Usually the impact of the secret leaking is that you can impersonate anyone, not that you can run arbitrary code, but the practice of using a session secret is common and not a bad practice nor broken inherently. 3 as well I think is unfair. That isn't something facebook implemented or is relying on;…

> Using a secret to sign or encrypt a cookie does normally work If the secret key is not compromised. So you have to ask yourself - why you send to the user some info that is so sensitive that needs signing? Why not just keep this info to yourself and send an opaque ID instead? Yes, I know there are issues with it too, but at least this issue is not there. > 3 as well I think is unfair. That isn't something facebook…

See JWT. You can make stateless apps easier without worrying about a trip to the database to grab session info

https://12factor.net/disposability

If you want disposability with the ID method you need some sort of datastore or cache to contain session info

Re: Remote Code Execution on a Facebook server

#202

Post by throwawaymath »

Grue3 wrote: post #196
tptacek wrote: post #188

Earlier quoted context omitted.

Look, this is Hacker News, I know you can come up with 1,000 different random arguments for why Facebook was wrong and this guy was right. What I can tell you with confidence is that if you did what this researcher did as a contract pentester, you'd get your firm permanently fired from Facebook (or virtually any other major site you might have been testing), and would probably be immediately fired yourself. What he d…

So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about. >He back-pocketed credentials, didn't tell anyone he had them It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario.

> So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.

He didn't say that at all. Your thesis here is that preventative discovery has no utility if it does not perfectly simulate real world conditions. That's a pretty extreme position; I don't think you'll sell many people on it.

> It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario.

I think you'll have a hard time finding companies who are okay with security professionals taking sensitive data for themselves just because they're reporting a vulnerability.

Re: Remote Code Execution on a Facebook server

#203

Post by nickthemagicman »

ebikelaw wrote: post #174
nickthemagicman wrote: post #150

So they were pickeling EXECUTABLE objects in the session and storing it in the users browser cookie? Interesting. Nice find.

There is no such thing as non-executable pickle. Pickle is not safe and must not be used for anything, ever.

Wow. I have to look into it. That sounds wildy unsafe

Re: Remote Code Execution on a Facebook server

#204

Post by pjmlp »

tluyben2 wrote: post #173
panopticon wrote: post #143

Earlier quoted context omitted.

I think you're a little over-confident in the Node community; I've seen a lot of Node apps deployed the same as any other (just tar'ed up and deployed via some kind of script or other deployment tool).

Seems a bit of the HN echo chamber; people here seem to think, because of the high quality stories and comments, that the entire world uses best practices for everything; containers, code reviews, versioning, test coverage, CI, automated deployments, etc. While in reality I think most places are not doing that. This is anecdotal ofcourse but most (large and small) companies I have worked with (as clients or partners)…

Quite true. I hardly see any of the best practices that keep being discussed here.

Small to middle size companies whose main business is totally unrelated to selling software just care that their stuff works somehow. And everything that IT does is a cost center.

Re: Remote Code Execution on a Facebook server

#205

Post by meowface »

tedunangst wrote: post #170
meowface wrote: post #161

Earlier quoted context omitted.

Honestly, just a gut feeling. (So, my ass.) I just feel like RCE should warrant somewhere around that much by default, even if the overall impact isn't high in a particular case. Some combination of potential impact and nature of the vulnerability/exposure should go into reward calculations, in my opinion.

But is RCE worth 15 because he got 5? If he'd gotten 1, would you say he deserved 5? Or 3?

I think I would've said something close to $15k either way. $5k isn't insulting (in my opinion) given the context. $1k would definitely be insulting.

Re: Remote Code Execution on a Facebook server

#206

Post by jrochkind1 »

bm1362 wrote: post #195
jrochkind1 wrote: post #123

Earlier quoted context omitted.

Even without the pickle-related vulnerability, exposing your secret key that is securing cookies seems pretty bad and likely to lead to other vulnerabilities, although they'd take longer to find. And if the secret key were secure, the pickle use would not be vulnerable. Still, multiple layers of security, yadda yadda, sure. But this is beyond the pickle issue. I'm not sure I'm completely convinced you should not use…

Isn’t it still an escalation of privileges? You’ve gone from having a proper session of system A (limited damage potentially) into code execution on machine Z.

yup, sounds right.

Re: Remote Code Execution on a Facebook server

#207

Post by dang »

Kiro wrote: post #154
jwilk wrote: post #127

Earlier quoted context omitted.

From the HN guidelines: Please don't insinuate that someone hasn't read an article.

Not applicable when it's obvious that the poster hasn't read the article, like in this case.

It's applicable precisely in that case.
Post reply on HN