6 ms·

“Let The Hacking Begin” Declares Person Who Hacked Zuckerberg’s Facebook Page

72 points by remi 16y ago

mayank 16y ago
Very interesting -- I wonder if this is the result of having so many API access points. The documentation page lists FBML+FQL, Graph, "Old Rest API", and "Old Javascript Client Library" as options: http://developers.facebook.com/docs/ http://developers.facebook.com/docs/ Or are we back to good old XSS attacks?
tokenadult 16y ago
I wonder what HNers think is the way that this was done?
- mayank 16y ago
  I wouldn't rule out some guy following Zuck around Palo Alto with airtools and hijacking cookies.
  - redthrowaway 16y ago
    It would be rather poetic if he just used firesheep, but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. Possible, but unlikely.
    - matwood 16y ago
      With apps on both the iPhone and Android wouldn't it be possible for his phone to poll the FB site in the background without his knowledge? EDIT I know 3G is encrypted. What I'm wondering though is if you ever let your phone join an unencrypted wifi network (say at a coffee shop) would it remember the network and then join again automatically the next time you are there?
      - redthrowaway 16y ago
        3G is encrypted [1], so it would still have to be on an open wifi. [1] http://en.wikipedia.org/wiki/3g#Security http://en.wikipedia.org/wiki/3g#Security
        w1ntermute 16y ago
        Zuckerberg's probably got an iPhone, and 3G GSM encryption's been cracked: http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked-in-less-than-two-hours/ http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked...
        deleted 16y ago
        [deleted]
        redthrowaway 16y ago
        I'd be interested to see if an optimized implementation of that attack could be run in a convenient timeframe for a cafe-sniffing attack. The article you linked mentioned a 2 hour attack window; something in the sub-15 minute range would be a pressing concern.
        w1ntermute 16y ago
        Only something in the sub-15 minute range would be a concern for you or me, but don't forget that this is Zuckerberg - it's not at all impossible that someone followed him around for 2 hours to crack his GSM encryption.
      - redthrowaway 16y ago
        Possibly. Worth an experiment, at any rate. I suspect the behaviour in question would depend upon the phone, unless the iOS/Android/BB apps are all functionally the same.
    - mayank 16y ago
      > but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. He'd just have to be logged in, not specifically accessing his fan page, and there's a nice Starbucks near the Facebook campus in Palo Alto that has free (unencrypted) wifi. Or maybe that's all Starbucks these days...
- deutronium 16y ago
  Does facebook use captchas, to slow bruteforcing, I tried entering a few wrong passwords for my account but didn't get one. However I doubt that bruteforcing or a dictionary attack was used.
  - socialmediaking 16y ago
    facebook doesn't use captcha's as much as it does other security features. if there is a log-in from an ip address that seems suspicious, it can ask you to identify your friends in photos to verify your identity.
    - RyanHolliday 16y ago
      Which is actually so much less annoying than captcha. Seems less secure (probably trivial for people you know to break in) but it's certainly a novel approach.
  - trotsky 16y ago
    captchas really aren't particularly suited to the task. The difference between even the most forgetful user and the lowest key bruteforce is so many orders of magnitude that it should be trivial to detect. I have no idea what facebook does, but most services just make it too slow to be practical: progressively slower responses, rate limiting, lockout periods. Another approach is to fail all authentications over a rate limit so that even if the correct password is guessed the attacker doesn't know. Long story short is defending a service against brute forcing is generally pretty easy.
- bradly 16y ago
  Firesheep. The way iFrames are used by so many 3rd party sites to pull in likes, you don't even need to be on Facebook to be vulnerable.
  - lukeschlather 16y ago
    That's why I only use Chrome to browse Facebook, and use Firefox with NoScript for everything else. And I regularly completely wipe personal data from Chrome (which interestingly doesn't give a mechanism to delete cookies on a per-site basis.)
    - streeter 16y ago
      Chrome does let you delete individual cookies and other data for sites. Preferences -> Under the Hood -> Content Settings -> All Cookies and Other Data -> search for site and hit remove. This is with the dev channel version of Chrome.
      - lukeschlather 16y ago
        Ah. I guess it's always been there. I was just expecting the title to match Firefox's "remove individual cookies." Reminds me of the "Add/Remove Programs" -> "Programs and Features" switch between XP and Vista.
- trotsky 16y ago
  Nine times out of ten a targeted intrusion like this will have been the result of a spearphishing attack - malicious pdf, malicious link etc sent directly to a small chosen set of people. I'm not personally familiar with how a high traffic fan page like this is managed, but I guess a fair number of people have access to it to delete spam, forward on interesting messages etc. It seems to me that a lot of those people might have the technical ability to post a new message - they may just be constrained by policy. So that's perhaps dozens of potential unsophisticated targets - interns, junior PR staffers. Like shooting fish in a barrel.
- winfred 16y ago
  Drunk intern that left three months ago and no password change policy on the account (*which I assume is used by the PR department, not Zuckerberg himself) .
- tastybites 16y ago
  I think everyone here is overthinking it. He probably just left his account logged in at a friend's house.
- trotsky 16y ago
  Target: the moderators/judges of the facebook coding contest Approach: post links on the contest page to a site that claims to know future questions, write code for you, process your data whatever. They'll get deleted but some staff will inevitably want to check if it's legit. Method: Today's money is on the IE CSS use after free bug - unpatched and widely available. Get some ie traffic by "this site requires Internet Explorer". Some other month it'd be a jre/flash/quicktime/pdf. Execution: Transitory system access on one or more clients. Reverse shell or basic payload, good rootkits are expensive. Simplest is just copy cookies/autofills/saved passwords/ssh keys - for extra credit install a keylogger. Low and behold, poorly_paid_intern not only despams the contest page but does the same for zuck's pr account. IMO not a local wireless attack - who on the peninsula would have such a idealized view of facebook's financing? Also US citizen+high profile=bad idea, see doing a year for guessing Sarah's yahoo.
shaunxcode 16y ago
here's a direct link to where the short url was pointed: http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e466a552708fc6e3863ef&thanksforthecup=https://www.facebook.com/photo.php%3Fpid%3D393752%26id%3D133954286636768%26fbid%3D170535036312026 http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e4... http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e466a552708fc6e3863ef&thanksforthecup=https://www.facebook.com/photo.php%3Fpid%3D393752%26id%3D133954286636768%26fbid%3D170535036312026
trotsky 16y ago
If facebook needs money, instead of going to the banks, why doesn’t Facebook let its users invest in Facebook in a social way? Unnamed hacker reinvents IPO, tells world.
- deleted 16y ago
  [deleted]
- michaelchisari 16y ago
  Well, damn, I'm not getting any sleep tonight. That's brilliant, I'll have to find a way to make it work.
- bane 16y ago
  I think that's already been invented in several forms: Here's 2 a) Users donate money, a la wikipedia (except with FB they can advertise that they are great people and donated, thereby encouraging others to donate) b) Users pay for access, subscription or some such. If it's optional, paying users get perks (more space for photos, searches across the graph, etc.)
  - axod 16y ago
    There were also several startups that gave out shares to their users during the last boom. I read it as suggesting the above - just give each facebook user a few shares in facebook.
law 16y ago
I bet Mark Zuckerberg made that post, masquerading as a hacker. It wouldn't be the first time he's pretended to be one.
- icandoitbetter 16y ago
  Jealous?
  - law 16y ago
    Clearly.
motters 16y ago
The social business model http://www.youtube.com/watch?v=0C3XQ3BTd4o http://www.youtube.com/watch?v=0C3XQ3BTd4o
jedsmith 16y ago
Anyone else notice that the headline authoritatively declares that it was a hack, then the article copy indicates that they're not sure? Shocker, right?
izendejas 16y ago
Here's what a commenter, DogGunn, had to say (I copy below as I'm not sure it'll stay at the top): "Article is wrong. Mark's profile is here: http://www.facebook.com/zuck http://www.facebook.com/zuck And his like page is here: http://www.facebook.com/pages/.. http://www.facebook.com/pages/... Neither were hacked. Someone had setup a fake profile at http://www.facebook.com/markzu.. http://www.facebook.com/markzu... and fooled Techcrunch. Facebook fixed by deleting the fake profile." A quick copy+paste pretty much confirmed it for me.

72 points by remi 16y ago

Very interesting -- I wonder if this is the result of having so many API access points. The documentation page lists FBML+FQL, Graph, "Old Rest API", and "Old Javascript Client Library" as options: http://developers.facebook.com/docs/ http://developers.facebook.com/docs/ Or are we back to good old XSS attacks?

tokenadult 16y ago

I wonder what HNers think is the way that this was done?

mayank 16y ago
I wouldn't rule out some guy following Zuck around Palo Alto with airtools and hijacking cookies.
- redthrowaway 16y ago
  It would be rather poetic if he just used firesheep, but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. Possible, but unlikely.
  - matwood 16y ago
    With apps on both the iPhone and Android wouldn't it be possible for his phone to poll the FB site in the background without his knowledge? EDIT I know 3G is encrypted. What I'm wondering though is if you ever let your phone join an unencrypted wifi network (say at a coffee shop) would it remember the network and then join again automatically the next time you are there?
    - redthrowaway 16y ago
      3G is encrypted [1], so it would still have to be on an open wifi. [1] http://en.wikipedia.org/wiki/3g#Security http://en.wikipedia.org/wiki/3g#Security
      - w1ntermute 16y ago
        Zuckerberg's probably got an iPhone, and 3G GSM encryption's been cracked: http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked-in-less-than-two-hours/ http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked...
        deleted 16y ago
        [deleted]
        redthrowaway 16y ago
        I'd be interested to see if an optimized implementation of that attack could be run in a convenient timeframe for a cafe-sniffing attack. The article you linked mentioned a 2 hour attack window; something in the sub-15 minute range would be a pressing concern.
        w1ntermute 16y ago
        Only something in the sub-15 minute range would be a concern for you or me, but don't forget that this is Zuckerberg - it's not at all impossible that someone followed him around for 2 hours to crack his GSM encryption.
    - redthrowaway 16y ago
      Possibly. Worth an experiment, at any rate. I suspect the behaviour in question would depend upon the phone, unless the iOS/Android/BB apps are all functionally the same.
  - mayank 16y ago
    > but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. He'd just have to be logged in, not specifically accessing his fan page, and there's a nice Starbucks near the Facebook campus in Palo Alto that has free (unencrypted) wifi. Or maybe that's all Starbucks these days...
deutronium 16y ago
Does facebook use captchas, to slow bruteforcing, I tried entering a few wrong passwords for my account but didn't get one. However I doubt that bruteforcing or a dictionary attack was used.
- socialmediaking 16y ago
  facebook doesn't use captcha's as much as it does other security features. if there is a log-in from an ip address that seems suspicious, it can ask you to identify your friends in photos to verify your identity.
  - RyanHolliday 16y ago
    Which is actually so much less annoying than captcha. Seems less secure (probably trivial for people you know to break in) but it's certainly a novel approach.
- trotsky 16y ago
  captchas really aren't particularly suited to the task. The difference between even the most forgetful user and the lowest key bruteforce is so many orders of magnitude that it should be trivial to detect. I have no idea what facebook does, but most services just make it too slow to be practical: progressively slower responses, rate limiting, lockout periods. Another approach is to fail all authentications over a rate limit so that even if the correct password is guessed the attacker doesn't know. Long story short is defending a service against brute forcing is generally pretty easy.
bradly 16y ago
Firesheep. The way iFrames are used by so many 3rd party sites to pull in likes, you don't even need to be on Facebook to be vulnerable.
- lukeschlather 16y ago
  That's why I only use Chrome to browse Facebook, and use Firefox with NoScript for everything else. And I regularly completely wipe personal data from Chrome (which interestingly doesn't give a mechanism to delete cookies on a per-site basis.)
  - streeter 16y ago
    Chrome does let you delete individual cookies and other data for sites. Preferences -> Under the Hood -> Content Settings -> All Cookies and Other Data -> search for site and hit remove. This is with the dev channel version of Chrome.
    - lukeschlather 16y ago
      Ah. I guess it's always been there. I was just expecting the title to match Firefox's "remove individual cookies." Reminds me of the "Add/Remove Programs" -> "Programs and Features" switch between XP and Vista.
trotsky 16y ago
Nine times out of ten a targeted intrusion like this will have been the result of a spearphishing attack - malicious pdf, malicious link etc sent directly to a small chosen set of people. I'm not personally familiar with how a high traffic fan page like this is managed, but I guess a fair number of people have access to it to delete spam, forward on interesting messages etc. It seems to me that a lot of those people might have the technical ability to post a new message - they may just be constrained by policy. So that's perhaps dozens of potential unsophisticated targets - interns, junior PR staffers. Like shooting fish in a barrel.
winfred 16y ago
Drunk intern that left three months ago and no password change policy on the account (*which I assume is used by the PR department, not Zuckerberg himself) .
tastybites 16y ago
I think everyone here is overthinking it. He probably just left his account logged in at a friend's house.
trotsky 16y ago
Target: the moderators/judges of the facebook coding contest Approach: post links on the contest page to a site that claims to know future questions, write code for you, process your data whatever. They'll get deleted but some staff will inevitably want to check if it's legit. Method: Today's money is on the IE CSS use after free bug - unpatched and widely available. Get some ie traffic by "this site requires Internet Explorer". Some other month it'd be a jre/flash/quicktime/pdf. Execution: Transitory system access on one or more clients. Reverse shell or basic payload, good rootkits are expensive. Simplest is just copy cookies/autofills/saved passwords/ssh keys - for extra credit install a keylogger. Low and behold, poorly_paid_intern not only despams the contest page but does the same for zuck's pr account. IMO not a local wireless attack - who on the peninsula would have such a idealized view of facebook's financing? Also US citizen+high profile=bad idea, see doing a year for guessing Sarah's yahoo.

shaunxcode 16y ago

here's a direct link to where the short url was pointed: http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e466a552708fc6e3863ef&thanksforthecup=https://www.facebook.com/photo.php%3Fpid%3D393752%26id%3D133954286636768%26fbid%3D170535036312026 http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e4... http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e466a552708fc6e3863ef&thanksforthecup=https://www.facebook.com/photo.php%3Fpid%3D393752%26id%3D133954286636768%26fbid%3D170535036312026

trotsky 16y ago

If facebook needs money, instead of going to the banks, why doesn’t Facebook let its users invest in Facebook in a social way? Unnamed hacker reinvents IPO, tells world.

deleted 16y ago
[deleted]
michaelchisari 16y ago
Well, damn, I'm not getting any sleep tonight. That's brilliant, I'll have to find a way to make it work.
bane 16y ago
I think that's already been invented in several forms: Here's 2 a) Users donate money, a la wikipedia (except with FB they can advertise that they are great people and donated, thereby encouraging others to donate) b) Users pay for access, subscription or some such. If it's optional, paying users get perks (more space for photos, searches across the graph, etc.)
- axod 16y ago
  There were also several startups that gave out shares to their users during the last boom. I read it as suggesting the above - just give each facebook user a few shares in facebook.

law 16y ago

I bet Mark Zuckerberg made that post, masquerading as a hacker. It wouldn't be the first time he's pretended to be one.

icandoitbetter 16y ago
Jealous?
- law 16y ago
  Clearly.

motters 16y ago

The social business model http://www.youtube.com/watch?v=0C3XQ3BTd4o http://www.youtube.com/watch?v=0C3XQ3BTd4o

jedsmith 16y ago

Anyone else notice that the headline authoritatively declares that it was a hack, then the article copy indicates that they're not sure? Shocker, right?

izendejas 16y ago

Here's what a commenter, DogGunn, had to say (I copy below as I'm not sure it'll stay at the top): "Article is wrong. Mark's profile is here: http://www.facebook.com/zuck http://www.facebook.com/zuck And his like page is here: http://www.facebook.com/pages/.. http://www.facebook.com/pages/... Neither were hacked. Someone had setup a fake profile at http://www.facebook.com/markzu.. http://www.facebook.com/markzu... and fooled Techcrunch. Facebook fixed by deleting the fake profile." A quick copy+paste pretty much confirmed it for me.