7 ms·

Tell HN: Forwarded Facebook emails automatically login as recipient

65 points by peteforde 8y ago

I'm rarely speechless, but my best friend - who is not a developer but tech-savvy - just forwarded an email invite to an event that she wants me to come to with her. The email was a standard transactional Facebook event notification. When I clicked on the event, I was logged into Facebook as my friend. Full privileges. I could have done anything. I logged out, called her immediately and explained that a) she shouldn't send anyone transactional emails from Facebook and b) that in my opinion, she hadn't done anything wrong. This is an outrageous security violation, as well as a violation of the principle of least surprise. It seems completely reasonable to me that someone would forward an event invitation to other people. I see this kind of thing with older folks, in particular. The obvious concern, here, is that someone could (not should) forward that email to a much larger group of people. In an era where people are unfortunately reliant on Facebook for their identity management, social connections and even professional networking, the idea of losing access to your Facebook profile to an unknown actor is terrifying. I don't understand how this ever made it past QA. If you work at Facebook, fix this right now.

artemisyna 8y ago
You sure your friend hadn't previously logged in to her FB on whatever browser your email happened to open things to?
- peteforde 8y ago
  Yes. She's never been on or near this machine. I have no idea of her credentials, and nor would I want to.
  - subcosmos 8y ago
    token string in the URL?
    - peteforde 8y ago
      Correct.
gojomo 8y ago
Can't reproduce. #WONTFIX. Closing. [If we're pretending HN is an FB security-issue reporting-system, I'll pretend I'm an inattentive FB engineer!]
- peteforde 8y ago
  I was just able to login again, using the same email link. Proof: https://imgur.com/a/AgTVgZK https://imgur.com/a/AgTVgZK
  - subcosmos 8y ago
    under an incognito tab?
    - peteforde 8y ago
      No, Incognito forces a login. My browser has a Facebook user logged in. However, this user is a dev account that has zero friends. This shouldn't, IMHO, change anything.
      - subcosmos 8y ago
        ^ this right here is critical. Dev accounts tend to be more open to specific features .....
      - subcosmos 8y ago
        followup question : Is this an app "test user" account you are logged into? Has the user in question authorized the app you are developing?
        peteforde 8y ago
        My friend is not a test user, and my dev user is literally just for doing QA on social graph tags for an otherwise unrelated project. My friend hasn't seen my project or interacted with this dev account in any way.
eganist 8y ago
Any particular reason you didn't report this through facebook.com/whitehat after googling how to report security issues to facebook? Or attempt to reproduce it independently after reading instructions for best practices when doing so on the aforementioned page? I can only assume it's because these patterns and facilities weren't within your awareness at the time, which is fine, but ideally you may consider these both in the future. I point this out not only because this kind of blast looks bad (even among full-disclosure circles), but because if it's a valid find, you just passed up potentially a five figure sum.
- peteforde 8y ago
  Correct, and thank you. It's not my usual MO, but this strikes me as alarming. I will file a report over there as well. However, I have been inspired by Troy Hunt's recent posts. It's clear that action follows illumination.
  - subcosmos 8y ago
    I passed this to their oncall sec Question, was this a "someone invited you" email with a join button? Was it an RSVP reminder of an event? A confirmed email? Subject line would be useful.
    - peteforde 8y ago
      From: Facebook <notification@facebookmail.com> Subject: Event Invitation {string} Body starts with: {my friends' friend} invited you to {page}'s event There's no Join button, but there is a set of Going / Interested / Not Interested buttons in the standard Facebook styling. It's a calendar invitation.
  - eganist 8y ago
    I can't speak for him. I can only speak for myself, and I'd think twice and at least attempt to reproduce it independently and submit it to Facebook and wait to hear back that they won't fix it and try to understand why they won't fix it all before deciding to post this kind of find to the wild.
mr_monkeywrench 8y ago
Could you provide more info Oath2 shouldn't aloow this. Also you say you're logged in as a Dev acct. Dev accts are sandboxed to the dev app ID. Could you use Loom to show a video of this big?
- peteforde 8y ago
  For clarification, it's not a Facebook developer account. This is just a dummy account I've been using to verify the social graph headers are working when I post pages from an unrelated project. It's technically against FB policy to have an account that isn't a real person. This dummy user has no friends; my human friend has not interacted with it in any way. I did post a partial screencap elsewhere in the thread. I'm not comfortable creating a video but I would be happy to provide further details to FB security folks. For what it's worth, part of the reason I posted to HN was that it's clear to me that this is intended functionality. Bugs don't usually say "welcome back". I believe that the risk associated with this feature dramatically outweighs the upside.
forgingahead 8y ago
This is great! Now every app that allows their users to sign in using their Google account, and asked for blanket "let's read all your email" permissions, can simply trawl through that data trove for this same email notification from Facebook, and have access to that user's account.
Hyperized 8y ago
For what it's worth: I actually reported this very issue to FB over two weeks ago and at first they denied this being an issue, it's a feature instead. After pushing a little I had them admit that this is actually a real security leak, however they argued that I was _not_ the first one to find and report this. That means no six figure bounty. They have since closed the ticket with what's basically a: will fix in the future. After some discussion I found the following: - Facebook at the very core assumes you don't forward your emails, the security staff I talked to didn't seem to understand this is a very basic flawed assumption. - It's by no means a one time use token, you can keep using it over and over again. I don't understand why, they could've just used a single use token if anything. - It's bound by some kind of security mechanism, and from my PoC I found it to be simply your IP. I suspect your friend has logged onto or simply used Facebook from your IP address. - The emails don't indicate the button you are about to press actually contains private information. This is bad UX. If people were told that the emails should be kept private and not shared (not the case) then this could be different. This _seems_ to be a feature that they built so people can log in, even if they have forgotten their passwords, in order to keep user engagements high. It also opens up a can of worms. For example, if you break up with a partner and you still have an ancient forwarded email, you can now simply log in as them and have full control over their account. I suspect there's also little protection for public WiFi that shares the same IP, such as coffee places, cafes/bars or public transport hubs. If you see anyone there that has ever forwarded you an email, you now own their account ;). But remember folks, that's not a bug. It's a feature! Edit: At this point I actually don't believe this is new for FB. For me this is proof that business overtook good engineering and that there's simply a box checked with 'accepted risk'. There is either no actual previous report or people have been reporting this for a long time, but there seems to be no willingness to fix this. To me it seemed to be hugely connected to last weeks '50 mil account token' leak but this is separate, accounts that I tested my PoC on can still be accessed and it's telling that even after last weeks PR nightmare this 'feature' is still online.
- peteforde 8y ago
  Thank you so much for your reply. 1. I'm perversely relieved that I did not throw away the magical 5-figure sum. 2. I can guarantee that my friend has never been to this house, so while there could be a security metric (which I can't think of) it's not the IP. 3. The fact that this is seen as an engagement feature and not a security loophole is disturbing even if there aren't a list of other scandals. 4. I no longer regret posting here. I'm pretty much the opposite of an attention seeker, but I hope that this discussion puts a bit more fire under their collective ass.
LocalMan 8y ago
Of course, the optimal way to respond to this is a contradiction: Raise a big stink, but secretly. This is not easy. I think the history of the "Tempest" security bug should be re-read every few years.
godot 8y ago
Unrelated to FB, but one of the things that popular email clients (Gmail, Hotmail, Yahoo, etc.) could be doing is a "forward without links" feature (or even "forward without links with credentials" by detecting for query params in links and only excluding those), where it'd be enabled when forwarding an email (you can manually disable it if you know what you're doing).
timdavila 8y ago
I've never understood why any company emails magic log-in links in anything except a password reset (which should immediately prompt for a new password and send the user a notice that their password has been changed)

65 points by peteforde 8y ago

artemisyna 8y ago

You sure your friend hadn't previously logged in to her FB on whatever browser your email happened to open things to?

peteforde 8y ago
Yes. She's never been on or near this machine. I have no idea of her credentials, and nor would I want to.
- subcosmos 8y ago
  token string in the URL?
  - peteforde 8y ago
    Correct.

gojomo 8y ago

Can't reproduce. #WONTFIX. Closing. [If we're pretending HN is an FB security-issue reporting-system, I'll pretend I'm an inattentive FB engineer!]

peteforde 8y ago
I was just able to login again, using the same email link. Proof: https://imgur.com/a/AgTVgZK https://imgur.com/a/AgTVgZK
- subcosmos 8y ago
  under an incognito tab?
  - peteforde 8y ago
    No, Incognito forces a login. My browser has a Facebook user logged in. However, this user is a dev account that has zero friends. This shouldn't, IMHO, change anything.
    - subcosmos 8y ago
      ^ this right here is critical. Dev accounts tend to be more open to specific features .....
    - subcosmos 8y ago
      followup question : Is this an app "test user" account you are logged into? Has the user in question authorized the app you are developing?
      - peteforde 8y ago
        My friend is not a test user, and my dev user is literally just for doing QA on social graph tags for an otherwise unrelated project. My friend hasn't seen my project or interacted with this dev account in any way.

eganist 8y ago

Any particular reason you didn't report this through facebook.com/whitehat after googling how to report security issues to facebook? Or attempt to reproduce it independently after reading instructions for best practices when doing so on the aforementioned page? I can only assume it's because these patterns and facilities weren't within your awareness at the time, which is fine, but ideally you may consider these both in the future. I point this out not only because this kind of blast looks bad (even among full-disclosure circles), but because if it's a valid find, you just passed up potentially a five figure sum.

peteforde 8y ago
Correct, and thank you. It's not my usual MO, but this strikes me as alarming. I will file a report over there as well. However, I have been inspired by Troy Hunt's recent posts. It's clear that action follows illumination.
- subcosmos 8y ago
  I passed this to their oncall sec Question, was this a "someone invited you" email with a join button? Was it an RSVP reminder of an event? A confirmed email? Subject line would be useful.
  - peteforde 8y ago
    From: Facebook <notification@facebookmail.com> Subject: Event Invitation {string} Body starts with: {my friends' friend} invited you to {page}'s event There's no Join button, but there is a set of Going / Interested / Not Interested buttons in the standard Facebook styling. It's a calendar invitation.
- eganist 8y ago
  I can't speak for him. I can only speak for myself, and I'd think twice and at least attempt to reproduce it independently and submit it to Facebook and wait to hear back that they won't fix it and try to understand why they won't fix it all before deciding to post this kind of find to the wild.

mr_monkeywrench 8y ago

Could you provide more info Oath2 shouldn't aloow this. Also you say you're logged in as a Dev acct. Dev accts are sandboxed to the dev app ID. Could you use Loom to show a video of this big?

peteforde 8y ago
For clarification, it's not a Facebook developer account. This is just a dummy account I've been using to verify the social graph headers are working when I post pages from an unrelated project. It's technically against FB policy to have an account that isn't a real person. This dummy user has no friends; my human friend has not interacted with it in any way. I did post a partial screencap elsewhere in the thread. I'm not comfortable creating a video but I would be happy to provide further details to FB security folks. For what it's worth, part of the reason I posted to HN was that it's clear to me that this is intended functionality. Bugs don't usually say "welcome back". I believe that the risk associated with this feature dramatically outweighs the upside.

forgingahead 8y ago

This is great! Now every app that allows their users to sign in using their Google account, and asked for blanket "let's read all your email" permissions, can simply trawl through that data trove for this same email notification from Facebook, and have access to that user's account.

Hyperized 8y ago

For what it's worth: I actually reported this very issue to FB over two weeks ago and at first they denied this being an issue, it's a feature instead. After pushing a little I had them admit that this is actually a real security leak, however they argued that I was _not_ the first one to find and report this. That means no six figure bounty. They have since closed the ticket with what's basically a: will fix in the future. After some discussion I found the following: - Facebook at the very core assumes you don't forward your emails, the security staff I talked to didn't seem to understand this is a very basic flawed assumption. - It's by no means a one time use token, you can keep using it over and over again. I don't understand why, they could've just used a single use token if anything. - It's bound by some kind of security mechanism, and from my PoC I found it to be simply your IP. I suspect your friend has logged onto or simply used Facebook from your IP address. - The emails don't indicate the button you are about to press actually contains private information. This is bad UX. If people were told that the emails should be kept private and not shared (not the case) then this could be different. This _seems_ to be a feature that they built so people can log in, even if they have forgotten their passwords, in order to keep user engagements high. It also opens up a can of worms. For example, if you break up with a partner and you still have an ancient forwarded email, you can now simply log in as them and have full control over their account. I suspect there's also little protection for public WiFi that shares the same IP, such as coffee places, cafes/bars or public transport hubs. If you see anyone there that has ever forwarded you an email, you now own their account ;). But remember folks, that's not a bug. It's a feature! Edit: At this point I actually don't believe this is new for FB. For me this is proof that business overtook good engineering and that there's simply a box checked with 'accepted risk'. There is either no actual previous report or people have been reporting this for a long time, but there seems to be no willingness to fix this. To me it seemed to be hugely connected to last weeks '50 mil account token' leak but this is separate, accounts that I tested my PoC on can still be accessed and it's telling that even after last weeks PR nightmare this 'feature' is still online.

peteforde 8y ago
Thank you so much for your reply. 1. I'm perversely relieved that I did not throw away the magical 5-figure sum. 2. I can guarantee that my friend has never been to this house, so while there could be a security metric (which I can't think of) it's not the IP. 3. The fact that this is seen as an engagement feature and not a security loophole is disturbing even if there aren't a list of other scandals. 4. I no longer regret posting here. I'm pretty much the opposite of an attention seeker, but I hope that this discussion puts a bit more fire under their collective ass.

LocalMan 8y ago

Of course, the optimal way to respond to this is a contradiction: Raise a big stink, but secretly. This is not easy. I think the history of the "Tempest" security bug should be re-read every few years.

godot 8y ago

Unrelated to FB, but one of the things that popular email clients (Gmail, Hotmail, Yahoo, etc.) could be doing is a "forward without links" feature (or even "forward without links with credentials" by detecting for query params in links and only excluding those), where it'd be enabled when forwarding an email (you can manually disable it if you know what you're doing).

timdavila 8y ago

I've never understood why any company emails magic log-in links in anything except a password reset (which should immediately prompt for a new password and send the user a notice that their password has been changed)