7 ms·

This is Reginaldo from the Facebook Security team. We're really glad Orange reported this to us. On this case, the software we were using is third party. As we

This is Reginaldo from the Facebook Security team. We're really glad Orange reported this to us. On this case, the software we were using is third party. As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook. We do this precisely to have better security, as chromakode mentioned. After incident response, we determined that the activity Orange detected was in fact from another researcher who participates in our bounty program. Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access.

ledy 10y ago
https://www.facebook.com/sumyangriani.cieimouetz?fref=ts https://www.facebook.com/sumyangriani.cieimouetz?fref=ts
omash 10y ago
Is what the other researcher did (collecting usernames and passwords) in scope? Is it impossible to use these credentials to get above standard privs on any part of facebook?
d33 10y ago
This is pretty much why we shouldn't be trusting centralized services at the scale of Facebook. Given that two researchers got that far, sooner or later another will actually manage to escalate the privileges. And then, I'm not sure what we should be more afraid of - leaking it all to public or some three-letter agency using it for nefarious purposes... Seriously, don't do Facebook. Not even once.
- nemothekid 10y ago
  This reasoning is really flimsy. Are you suggesting a that a normal user will do better at securing their home grown system than a team of trained security engineers?
  - d33 10y ago
    I'd say that if it wasn't for Facebook, a lot of communication would take place over safer channels. If you doubt whether Facebook is insecure, click the "include 'only me' activity" in your activity log and imagine how much damage would happen if that leaked.
    - tptacek 10y ago
      You and I remember very different pre-centralization Internets. Before Google, decentralized hand-administered email services were probably the single most popular way to bust into someone else's servers.
      - d33 10y ago
        I'm not saying that we should go back to those times, I'm saying that we should be aiming for decentralization in the long run. It's not like the security paradigms we had back in the time are tied to decentralization. They're mostly tied to ignorance.
        scrollaway 10y ago
        Decentralization is great for many things but has little effect on security. Decentralized channels are not inherently safer. Aside on self-hosting: This reminds me a lot of the self-driving car accident debate. Self-driving cars could be thousands of times more reliable than humans, but unless they are mathematically perfect, some people feel safer driving themselves because they feel they are in control. Nevermind that Google/Facebook etc have millions of man hours invested into security.
        icebraining 10y ago
        I don't think it's so much that decentralized systems are technically safer, but that the people who own and control the centralized ones have incentives to keep them unsafe (at least from themselves) whereas if each person runs its own server, the incentives are properly aligned for security. In essence, it's an economic argument, not a technical one.
- onewaystreet 10y ago
  With that logic you might as well stop using the internet altogether.
- rnhmjoj 10y ago
  It's more like we shouldn't trust a third party closed source software for a task that is supposed to be done in a secure way.
outworlder 10y ago
> two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access. Are they allowed to escalate access, given the bounty rules? Also, isn't the periodic collection of login credentials completely out of scope? What I mean is: once the initial vulnerability was located and the pentester got shell access in the system, shouldn't he have stopped there and reported?
- apeace 10y ago
  > Are they allowed to escalate access, given the bounty rules? No. From Facebook's responsible disclosure policy [1]: > You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.) Both of the pen testers in this situation broke the rules. Once they found a security issue they exploited it and probed for additional issues (as well as one tester who attempted compromise of sensitive company data by collecting logins). It's good that Facebook doesn't always apply these guidelines to the letter. [1] https://www.facebook.com/whitehat https://www.facebook.com/whitehat
- Dr_tldr 10y ago
  You can read the story from a few months back to find that Facebook apparently has an unstated but non-repudiated policy of threatening to involve the FBI and actually doing reputational damage to researchers who they feel cross a (poorly described and enforced) line: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194 In this case, they (correctly) went the other way, which creates even more uncertainty. Given this pattern of inconsistent enforcement mixed with threats, I would feel genuinely unsafe reporting a security vulnerability to Facebook except under very specific conditions. That's probably not what they're going for, but that's the environment they're creating.
  - boredpudding 10y ago
    It's actually very easy: If you are in a server, you report it. You don't go digging for more, because once you're in, you can easily do more damage.
peterwwillis 10y ago
"As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook." "Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access." From the write-up: > After checking the browser, the SSL certificate of files.fb.com was * .fb.com … You left a wildcard cert on this random internet-facing unaudited 3rd party linux box with no protection against data exfiltration, or an HTTPS proxy in front of it, or anything? I know it's not as critical as facebook.com, but this is still bad. Priv escalation CVEs for Linux come out like every month. At the very least, using this cert, anyone could run a MITM on any * .fb.com service and compromise without ever breaking in. From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron. I'm hoping you did actually have a proxy in front of it and Orange just didn't catch that.
- onewaystreet 10y ago
  > no protection against data exfiltration That's a big assumption
  - Someone1234 10y ago
    Since the article exfiltrated data, no, it is a fact.
    - onewaystreet 10y ago
      If downloading any data from a hacked server counts as exfiltration then everyone could be said to have no protection against data exfiltration.
- brians 10y ago
  Figure that was probably a CDN, and you don't know the origin configuration
  - 10y ago
kosmic_k 10y ago
Facebook's stance on vulnerability research is incredibly admirable. I can only home more companies hold themselves to the same high standard.
jedicoffee 10y ago
This is quite confusing. "A brief summary, the hacker created a proxy on the credential page to log the credentials of Facebook employees. These logged passwords were stored under web directory for the hacker to use WGET every once in a while". So they were grabbing creds, but it's ok it was just a researcher? Pretty sure that's crossing the line and indicative of an actual compromise of employee credentials.
Davidghosh 10y ago
I believe, all rich firms,including FB,Microsoft,google and many others, who are fooling public and minting trillion $,will be hacked and more advance sophisticated tools will be invented by a specific hacking group to hack them.Look Panama Paper.It is also a science & advance technology. David Ghosh
7060731742 10y ago
i am problum id

ledy 10y ago

https://www.facebook.com/sumyangriani.cieimouetz?fref=ts https://www.facebook.com/sumyangriani.cieimouetz?fref=ts

omash 10y ago

Is what the other researcher did (collecting usernames and passwords) in scope? Is it impossible to use these credentials to get above standard privs on any part of facebook?

d33 10y ago

This is pretty much why we shouldn't be trusting centralized services at the scale of Facebook. Given that two researchers got that far, sooner or later another will actually manage to escalate the privileges. And then, I'm not sure what we should be more afraid of - leaking it all to public or some three-letter agency using it for nefarious purposes... Seriously, don't do Facebook. Not even once.

nemothekid 10y ago
This reasoning is really flimsy. Are you suggesting a that a normal user will do better at securing their home grown system than a team of trained security engineers?
- d33 10y ago
  I'd say that if it wasn't for Facebook, a lot of communication would take place over safer channels. If you doubt whether Facebook is insecure, click the "include 'only me' activity" in your activity log and imagine how much damage would happen if that leaked.
  - tptacek 10y ago
    You and I remember very different pre-centralization Internets. Before Google, decentralized hand-administered email services were probably the single most popular way to bust into someone else's servers.
    - d33 10y ago
      I'm not saying that we should go back to those times, I'm saying that we should be aiming for decentralization in the long run. It's not like the security paradigms we had back in the time are tied to decentralization. They're mostly tied to ignorance.
      - scrollaway 10y ago
        Decentralization is great for many things but has little effect on security. Decentralized channels are not inherently safer. Aside on self-hosting: This reminds me a lot of the self-driving car accident debate. Self-driving cars could be thousands of times more reliable than humans, but unless they are mathematically perfect, some people feel safer driving themselves because they feel they are in control. Nevermind that Google/Facebook etc have millions of man hours invested into security.
        icebraining 10y ago
        I don't think it's so much that decentralized systems are technically safer, but that the people who own and control the centralized ones have incentives to keep them unsafe (at least from themselves) whereas if each person runs its own server, the incentives are properly aligned for security. In essence, it's an economic argument, not a technical one.
onewaystreet 10y ago
With that logic you might as well stop using the internet altogether.
rnhmjoj 10y ago
It's more like we shouldn't trust a third party closed source software for a task that is supposed to be done in a secure way.

outworlder 10y ago

> two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access. Are they allowed to escalate access, given the bounty rules? Also, isn't the periodic collection of login credentials completely out of scope? What I mean is: once the initial vulnerability was located and the pentester got shell access in the system, shouldn't he have stopped there and reported?

apeace 10y ago
> Are they allowed to escalate access, given the bounty rules? No. From Facebook's responsible disclosure policy [1]: > You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.) Both of the pen testers in this situation broke the rules. Once they found a security issue they exploited it and probed for additional issues (as well as one tester who attempted compromise of sensitive company data by collecting logins). It's good that Facebook doesn't always apply these guidelines to the letter. [1] https://www.facebook.com/whitehat https://www.facebook.com/whitehat
Dr_tldr 10y ago
You can read the story from a few months back to find that Facebook apparently has an unstated but non-repudiated policy of threatening to involve the FBI and actually doing reputational damage to researchers who they feel cross a (poorly described and enforced) line: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194 In this case, they (correctly) went the other way, which creates even more uncertainty. Given this pattern of inconsistent enforcement mixed with threats, I would feel genuinely unsafe reporting a security vulnerability to Facebook except under very specific conditions. That's probably not what they're going for, but that's the environment they're creating.
- boredpudding 10y ago
  It's actually very easy: If you are in a server, you report it. You don't go digging for more, because once you're in, you can easily do more damage.

peterwwillis 10y ago

"As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook." "Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access." From the write-up: > After checking the browser, the SSL certificate of files.fb.com was * .fb.com … You left a wildcard cert on this random internet-facing unaudited 3rd party linux box with no protection against data exfiltration, or an HTTPS proxy in front of it, or anything? I know it's not as critical as facebook.com, but this is still bad. Priv escalation CVEs for Linux come out like every month. At the very least, using this cert, anyone could run a MITM on any * .fb.com service and compromise without ever breaking in. From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron. I'm hoping you did actually have a proxy in front of it and Orange just didn't catch that.

onewaystreet 10y ago
> no protection against data exfiltration That's a big assumption
- Someone1234 10y ago
  Since the article exfiltrated data, no, it is a fact.
  - onewaystreet 10y ago
    If downloading any data from a hacked server counts as exfiltration then everyone could be said to have no protection against data exfiltration.
brians 10y ago
Figure that was probably a CDN, and you don't know the origin configuration
- 10y ago

kosmic_k 10y ago

Facebook's stance on vulnerability research is incredibly admirable. I can only home more companies hold themselves to the same high standard.

jedicoffee 10y ago

This is quite confusing. "A brief summary, the hacker created a proxy on the credential page to log the credentials of Facebook employees. These logged passwords were stored under web directory for the hacker to use WGET every once in a while". So they were grabbing creds, but it's ok it was just a researcher? Pretty sure that's crossing the line and indicative of an actual compromise of employee credentials.

Davidghosh 10y ago

I believe, all rich firms,including FB,Microsoft,google and many others, who are fooling public and minting trillion $,will be hacked and more advance sophisticated tools will be invented by a specific hacking group to hack them.Look Panama Paper.It is also a science & advance technology. David Ghosh

7060731742 10y ago

i am problum id