Race conditions on Facebook, DigitalOcean and others (fixed)

More interesting than the bounty itself is to understand which defense works best at scale and the nitty gritty details of those kind of attacks. Intuitively I think that we just need to avoid inconsistencies between the Time of Check (TOC) and Time of Use (TOU), so veryfing the existence of a discount coupon while inserting it in one query should do the trick (INSERT INTO coupons (...) Values (...) WHERE NOT EXISTS (SELECT 1 FROM coupons WHERE (...)) instead of increasing the time between the TOC/TOU, e.g. one query to check if the coupon exists and a second one to insert the coupon. Besides it I am wondering if I am missing something, e.g. is this really a problem limited to the application layer or are the databases unable to prevent such attacks? I think I am right regarding the app protection, but let's see what people have to say :)

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#5

Post by numair » Mon, Apr 27, 2015, 1:29 AM UTC

I would be really interested to know how various forms of this bug are resolved. This seems like a problem that, on its surface, seems easy to fix, but isn't. Especially if you've designed your architecture for real-time-ness and global redundancy. Google's servers with atomic clocks come to mind...

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#6

Post by zhoutong » Mon, Apr 27, 2015, 1:30 AM UTC

andersonmvd wrote: post #4

More interesting than the bounty itself is to understand which defense works best at scale and the nitty gritty details of those kind of attacks. Intuitively I think that we just need to avoid inconsistencies between the Time of Check (TOC) and Time of Use (TOU), so veryfing the existence of a discount coupon while inserting it in one query should do the trick (INSERT INTO coupons (...) Values (...) WHERE NOT EXISTS…

Or just use a UNIQUE INDEX.

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#7

Post by franjkovic » Mon, Apr 27, 2015, 1:34 AM UTC

yesmade wrote: post #3

$3k for the facebook review bug. that's a little bit too much - update thanks for the downvotes guys. keep up the good work

The bounty actually surprised me, too. I expected between $1000-$2000. That is one of reasons I like reporting bugs to Facebook - they pay really good, critical bugs are fixed really fast (One time they paid me $5000 for a bug I never could have found, but they did internally based on my low severity report. (http://josipfranjkovic.blogspot.com/2013/11/facebook-bug-bou...)

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#8

Post by ejcx » Mon, Apr 27, 2015, 1:35 AM UTC

I actually fixed the issue that was reported to LastPass.

I could be mistaken but I believe he reported the security issue through our regular support channel which is why it took three days to see (instead of our security channel). From the time I saw it, I fixed it with the patch going live within an hour or two.

When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same request a bunch of times, I just kind of chuckled. It was a good bug. Josip is top notch.

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#9

Post by inportb » Mon, Apr 27, 2015, 1:37 AM UTC

So the review bug was a security issue but the username bug wasn't? I wonder what else the review bug affected.

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#10

Post by mwsherman » Mon, Apr 27, 2015, 1:38 AM UTC

franjkovic wrote: post #7

yesmade wrote: post #3

$3k for the facebook review bug. that's a little bit too much - update thanks for the downvotes guys. keep up the good work

The bounty actually surprised me, too. I expected between $1000-$2000. That is one of reasons I like reporting bugs to Facebook - they pay really good, critical bugs are fixed really fast ( One time they paid me $5000 for a bug I never could have found, but they did internally based on my low severity report. ( http://josipfranjkovic.blogspot.com/2013/11/facebook-bug-bou... )

It’s impressive that they are able to fix them so quickly – one needs to imagine they get a non-trivial number of reports, and that some majority of them are junk. They have a good triage + repro + escalation system.