4 ms·
As someone outside the infosec industry, I think the dissonance I feel reading this comes from this line: "[Alex] then explained that the vulnerability I found
by dhimes 11y ago
As someone outside the infosec industry, I think the dissonance I feel reading this comes from this line:
"[Alex] then explained that the vulnerability I found was trivial and of little value"
coupled with the fact that he seemed to be very worried about the problems that could be caused by the author in exploiting it. Something seems amiss.
- pests 11y agoI feel he meant the original RCE Ruby bug which then allowed all this extra access. It was not some huge, architecture-changing security problem, just a simple upgrade to fix.
- brazzledazzle 11y agoWhat he revealed however, was that Facebook doesn't pay attention to least privilege with key access, what those keys access[1] and more importantly where those keys access data from[2]. I have a feeling there's some scrambling to cover these blind spots over at Facebook. [1] http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.ht... [2] http://docs.aws.amazon.com/AmazonS3/latest/dev/LogFormat.html http://docs.aws.amazon.com/AmazonS3/latest/dev/LogFormat.htm...
- deleted 11y ago[deleted]
- bloaf 11y agoNothing in here is exactly wrong, but we do have to acknowledge that this whole back and forth has essentially informed everyone that: Facebook considers the keys to their kingdom to be worth $2,500. OR Facebook doesn't know what the keys to it's kingdom look like. Facebook will not update keys/credentials even if they are known to be compromised. If you have the keys to the kingdom, you can use them and Facebook won't find out about it unless you tell them.
- vghack 11y agoIt's weird how this flies over the head of so many.