4 ms·

Any particular reason you didn't report this through facebook.com/whitehat after googling how to report security issues to facebook? Or attempt to reproduce it

Any particular reason you didn't report this through facebook.com/whitehat after googling how to report security issues to facebook? Or attempt to reproduce it independently after reading instructions for best practices when doing so on the aforementioned page? I can only assume it's because these patterns and facilities weren't within your awareness at the time, which is fine, but ideally you may consider these both in the future. I point this out not only because this kind of blast looks bad (even among full-disclosure circles), but because if it's a valid find, you just passed up potentially a five figure sum.

peteforde 8y ago
Correct, and thank you. It's not my usual MO, but this strikes me as alarming. I will file a report over there as well. However, I have been inspired by Troy Hunt's recent posts. It's clear that action follows illumination.
- subcosmos 8y ago
  I passed this to their oncall sec Question, was this a "someone invited you" email with a join button? Was it an RSVP reminder of an event? A confirmed email? Subject line would be useful.
  - peteforde 8y ago
    From: Facebook <notification@facebookmail.com> Subject: Event Invitation {string} Body starts with: {my friends' friend} invited you to {page}'s event There's no Join button, but there is a set of Going / Interested / Not Interested buttons in the standard Facebook styling. It's a calendar invitation.
- eganist 8y ago
  I can't speak for him. I can only speak for myself, and I'd think twice and at least attempt to reproduce it independently and submit it to Facebook and wait to hear back that they won't fix it and try to understand why they won't fix it all before deciding to post this kind of find to the wild.
khazhou 8y ago
I will kindly suggest that in the future, instead of phrasing advice in the form of "Any particular reason you didn't do the thing which to me is obviously the only smart thing to do?", you could give feedback more prescriptively and without any implied accusations. For example: "peteforde, in the future please do the following instead of posting on HN: - Google "how to report security issues to <whatever company>" - In this case, you will be directed to facebook.com/whitehat - You should try to reproduce this independently first, after reading the best practices for doing so at the URL above. And, there may be a five-figure sum for you if you indeed find a vulnerability, and report it as above."
- eganist 8y ago
  Your guidance has been noted and is appreciated. I'm leaving my initial post unedited not only for context but because I feel it conveys a certain gravity as to the discoverability of the best practice that was missed here. I'm generally a fan of the feedback pattern you described... but not always. Egregious impermissible disclosures of any sort--security, PHI/PCI/PII/FERPA, etc. all fall in the "not always" bucket for me.
- insickness 8y ago
  To me the wording, "Any particular reason you didn't do x?" wasn't an implied accusation. In fact it was the opposite. It was assumed that the original poster had taken all measures and had a good reason why they didn't take the action. It is similar to saying, "Have you considered...?" It is a less combative way to say, "You should have done x," which does implied that the original poster did something wrong.
  - kapauldo 8y ago
    It's a hostile way to talk to someone who's doing something nice
true_religion 8y ago
This is not a security breech or bug, it is the intentional design of Facebook. It is like complaining that if you give away your password, someone can login as you, thus Facebook ought to iasue two factor auth dongles. That is not the sort of thing to forward to facebooks abuse department. It requires a policy change for a different authentication method, and that is something that can be freely and publically discussed.
- Hyperized 8y ago
  It actually is a huge risk. You make the same flawed assumption many people (including the folks over at FB) make, that your email is private and that once it's breached it's game over anyway. The reason we came across this issue a while ago (see below) is that an elderly family member was forwarding emails when people had invited this person to an event. This family member knows better than to forward emails regarding password resets and account details. They really didn't do anything wrong. They just unbeknownst to them shared full account access to 50 other people. Nowhere in this email does it say 'dont forward' and the expectation of anyone to click at one of those email links would be to be prompted credentials when they are not currently logged in as that person. Now, no matter on what device you are, it seems you can with one click be granted access to the entire account based on that link alone. It's not even a one time use token, it's a all free pass. Social engineering wise it's so simple: "Hey buddy, that party tonight, do you still have the invite email? I forgot and I'm on my way to work now." - done.
  - pasbesoin 8y ago
    Prefix: I haven't confirmed yet that the OP error report is legitimate/accurate. Haven't been on FB in a while. -- Yes. If you pay any attention to how users actually behave, this scenario is very obvious -- not just obvious, but observed, regularly. "You're not doing it right" is not an excuse -- in any measure -- in a scenario such as this. People forward emails. All the time. That often includes stuff they didn't intend to. Much less links they have no idea will provide the recipient access to their account. Reminder [sorry if this is a bit stereotypical]: Sewing circle Saturday at 2. "I should send this to Sue and Pam, so they don't forget this month." Or, Notice: Book club next Friday instead of this. "I'd better let Steve know. He never checks his schedule until the last moment, if then." At one point, I had to check BigCo's email flows and behaviors. I sure as heck checked for things like this. P.S. I guess I'll mention that one time, I caught a Google Docs non-email-related "lingering access" vulnerability. Google was going to close it as a non-issue or won't fix, until I pointed out its impact on their government Docs deployments and that I knew who to talk to on the government side. Then, it got fixed. I hope we're not going further down the "some people matter more than others" hole. We already have help triage by social media prominence. In that vein, maybe all that's left is to zero-day them (BigTechCo, in general), until they pro-actively improve their internal processes as well as external responsiveness.
x220 8y ago
This is Facebook. Public shame is the only way to reliably get them to change policy even slightly on something they have already made a decision about.

peteforde 8y ago

Correct, and thank you. It's not my usual MO, but this strikes me as alarming. I will file a report over there as well. However, I have been inspired by Troy Hunt's recent posts. It's clear that action follows illumination.

subcosmos 8y ago
I passed this to their oncall sec Question, was this a "someone invited you" email with a join button? Was it an RSVP reminder of an event? A confirmed email? Subject line would be useful.
- peteforde 8y ago
  From: Facebook <notification@facebookmail.com> Subject: Event Invitation {string} Body starts with: {my friends' friend} invited you to {page}'s event There's no Join button, but there is a set of Going / Interested / Not Interested buttons in the standard Facebook styling. It's a calendar invitation.
eganist 8y ago
I can't speak for him. I can only speak for myself, and I'd think twice and at least attempt to reproduce it independently and submit it to Facebook and wait to hear back that they won't fix it and try to understand why they won't fix it all before deciding to post this kind of find to the wild.

khazhou 8y ago

I will kindly suggest that in the future, instead of phrasing advice in the form of "Any particular reason you didn't do the thing which to me is obviously the only smart thing to do?", you could give feedback more prescriptively and without any implied accusations. For example: "peteforde, in the future please do the following instead of posting on HN: - Google "how to report security issues to <whatever company>" - In this case, you will be directed to facebook.com/whitehat - You should try to reproduce this independently first, after reading the best practices for doing so at the URL above. And, there may be a five-figure sum for you if you indeed find a vulnerability, and report it as above."

eganist 8y ago
Your guidance has been noted and is appreciated. I'm leaving my initial post unedited not only for context but because I feel it conveys a certain gravity as to the discoverability of the best practice that was missed here. I'm generally a fan of the feedback pattern you described... but not always. Egregious impermissible disclosures of any sort--security, PHI/PCI/PII/FERPA, etc. all fall in the "not always" bucket for me.
insickness 8y ago
To me the wording, "Any particular reason you didn't do x?" wasn't an implied accusation. In fact it was the opposite. It was assumed that the original poster had taken all measures and had a good reason why they didn't take the action. It is similar to saying, "Have you considered...?" It is a less combative way to say, "You should have done x," which does implied that the original poster did something wrong.
- kapauldo 8y ago
  It's a hostile way to talk to someone who's doing something nice

true_religion 8y ago

This is not a security breech or bug, it is the intentional design of Facebook. It is like complaining that if you give away your password, someone can login as you, thus Facebook ought to iasue two factor auth dongles. That is not the sort of thing to forward to facebooks abuse department. It requires a policy change for a different authentication method, and that is something that can be freely and publically discussed.

Hyperized 8y ago
It actually is a huge risk. You make the same flawed assumption many people (including the folks over at FB) make, that your email is private and that once it's breached it's game over anyway. The reason we came across this issue a while ago (see below) is that an elderly family member was forwarding emails when people had invited this person to an event. This family member knows better than to forward emails regarding password resets and account details. They really didn't do anything wrong. They just unbeknownst to them shared full account access to 50 other people. Nowhere in this email does it say 'dont forward' and the expectation of anyone to click at one of those email links would be to be prompted credentials when they are not currently logged in as that person. Now, no matter on what device you are, it seems you can with one click be granted access to the entire account based on that link alone. It's not even a one time use token, it's a all free pass. Social engineering wise it's so simple: "Hey buddy, that party tonight, do you still have the invite email? I forgot and I'm on my way to work now." - done.
- pasbesoin 8y ago
  Prefix: I haven't confirmed yet that the OP error report is legitimate/accurate. Haven't been on FB in a while. -- Yes. If you pay any attention to how users actually behave, this scenario is very obvious -- not just obvious, but observed, regularly. "You're not doing it right" is not an excuse -- in any measure -- in a scenario such as this. People forward emails. All the time. That often includes stuff they didn't intend to. Much less links they have no idea will provide the recipient access to their account. Reminder [sorry if this is a bit stereotypical]: Sewing circle Saturday at 2. "I should send this to Sue and Pam, so they don't forget this month." Or, Notice: Book club next Friday instead of this. "I'd better let Steve know. He never checks his schedule until the last moment, if then." At one point, I had to check BigCo's email flows and behaviors. I sure as heck checked for things like this. P.S. I guess I'll mention that one time, I caught a Google Docs non-email-related "lingering access" vulnerability. Google was going to close it as a non-issue or won't fix, until I pointed out its impact on their government Docs deployments and that I knew who to talk to on the government side. Then, it got fixed. I hope we're not going further down the "some people matter more than others" hole. We already have help triage by social media prominence. In that vein, maybe all that's left is to zero-day them (BigTechCo, in general), until they pro-actively improve their internal processes as well as external responsiveness.

x220 8y ago

This is Facebook. Public shame is the only way to reliably get them to change policy even slightly on something they have already made a decision about.