Delete any Photo from Facebook by Exploiting Support Dashboard
arulxtronix.blogspot.in
Delete any Photo from Facebook by Exploiting Support Dashboard
1–10 of 32 posts
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#2Facebook really doesn't test anything for security vulnerabilities before pushing to production, do they?
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#3This guy was lucky to be proficient enough in English to recieve the bounty, unlike this guy:
http://www.theverge.com/2013/8/18/4633046/facebook-security-...
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#4This guy was lucky to be proficient enough in English to recieve the bounty, unlike this guy: http://www.theverge.com/2013/8/18/4633046/facebook-security-...
He might even get into Y combinator, if he tried.
There, I did it. Haha.
Can we stop beating dead horses, we all read Hacker News around here?
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#5Facebook really doesn't test anything for security vulnerabilities before pushing to production, do they?
Do you?
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#6Facebook really doesn't test anything for security vulnerabilities before pushing to production, do they?
They most likely do test for security vulnerabilities. However, the attack surface and overall complexity is so large that things will slip by even with the most rigorous testing.
For now, the best you can hope for is a layered defense and rigorous dev and ops practices to help minimize the attack surface and reduce the overall damage a single successful attack can achieve.
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#7wow that's a nice bounty for changing two parameters on the end of a URL.
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#8Facebook really doesn't test anything for security vulnerabilities before pushing to production, do they?
I think we can all agree that it's both a very difficult and a very large task to maintain an application with 500 million active users, let alone continue innovation and expansion.
Testing can only ever go so far - bugs and vulnerabilities exist everywhere, even in Facebook.
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#9As I understand it, the exploit involves crafting a URL to send in a removal request to the Facebook support. Wouldn't this count as social engineering or were the removal requests automated?
Regardless, well done!
Re: Delete any Photo from Facebook by Exploiting Support Dashboard
#10Facebook really doesn't test anything for security vulnerabilities before pushing to production, do they?
They most likely do test for security vulnerabilities. However, the attack surface and overall complexity is so large that things will slip by even with the most rigorous testing. For now, the best you can hope for is a layered defense and rigorous dev and ops practices to help minimize the attack surface and reduce the overall damage a single successful attack can achieve.
Putting the user id in the request is obviously wrong, since the owner can looked up from the photo id.
Automated testing/fuzzing could find this, but probably better training/practices would be easier to get right and save time/money in the long run.