4 ms·
"As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook." "Neither of them were able to compromis
by peterwwillis 11y ago
"As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook."
"Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access."
From the write-up:
> After checking the browser, the SSL certificate of files.fb.com was * .fb.com …
You left a wildcard cert on this random internet-facing unaudited 3rd party linux box with no protection against data exfiltration, or an HTTPS proxy in front of it, or anything? I know it's not as critical as facebook.com, but this is still bad. Priv escalation CVEs for Linux come out like every month.
At the very least, using this cert, anyone could run a MITM on any * .fb.com service and compromise without ever breaking in. From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron. I'm hoping you did actually have a proxy in front of it and Orange just didn't catch that.
- onewaystreet 11y ago> no protection against data exfiltration That's a big assumption
- Someone1234 11y agoSince the article exfiltrated data, no, it is a fact.
- onewaystreet 11y agoIf downloading any data from a hacked server counts as exfiltration then everyone could be said to have no protection against data exfiltration.
- brians 11y agoFigure that was probably a CDN, and you don't know the origin configuration
- peterwwillis 11y agoI hope it was. But if it and the other services Orange found are just random internet-facing appliances, it's unlikely they would configure a CDN to get access, because CDNs are for public traffic typically. Nobody uses a CDN to open their outlook web mail to the Internet, for example. But they might have had a regular SSL proxy in front.... maybe.
- spicyj 11y ago> From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron. The article claims those are tfbnw.net, not fb.com.
- dkopi 11y ago"I'm hoping you did actually have a proxy in front of it and Orange just didn't catch that." That sounds a lot more reasonable than actually having the private key on each individual server.