3 ms·

Over the last 2 months, I've noticed Facebook has almost completely stopped responding to any vulnerability finds or bug bounty tickets submitted. It's gotten

Over the last 2 months, I've noticed Facebook has almost completely stopped responding to any vulnerability finds or bug bounty tickets submitted. It's gotten really bad. For instance, right now all 70,000,000 of the Facebook users in Vietnam have their information posted online on an open web server. I am not going to post it just yet in the last hope that someone from FB will reach out to me, but the info is their along with their IMEI number, cell phone number, information on what ads they've seen and clicked on, etc. For some users there are absolutely private messages, it appears to be only for Muslims in Vietnam though (so not all nor am I saying all). Until yesterday, the S3 bucket https://whatsapp-messages.s3.amazonaws.com https://whatsapp-messages.s3.amazonaws.com was open. You can search CNAME records if you have a SecurityTrails subscription, and this bucket belongs to a certain FB contractor. In fairness it could have been something known as "Domain Shadowing" whereby you secretly hack a groups subdomain records for evading firewall purposes, but in that case the argument still stands. It had over 13,000 pictures from various Latin American police departments that change every few days while I tracked it. NOTE: FB Security ppl, my email is in my profile. EDIT: This is a very good paper from Tsinghua University in 2016 on Domain Shadowing, which more people should be aware of. Check your subdomains, and make sure you use the free option in SecurityTrails to do it. Passive DNS checks aren't enough here: https://faculty.sites.uci.edu/zhouli/files/2018/09/ccs17.pdf https://faculty.sites.uci.edu/zhouli/files/2018/09/ccs17.pdf

spamfilter 7y ago
I'm sorry, rshnotsecure but until you come up with those 5k words you promised about ProtonMail, CreditKarma and a huge list of others being fronts for spy agencies[1] your posts will only ever be titillating scuttlebutt for me. Last we heard you had the lounge room covered in butcher's paper, plotting it all out and gave your literal word that you'd post that "report" within 96 hours. That was 42 days ago. I have no idea if what you say about FB's server in Vietnam is true and I'm not here to argue with you. The pity is that you post about interesting things. But if making big claims with unshakeable evidence "to come" which never actually arrives is something that we deplore in our politicians and mainstream media, why let it creep in here? [1] https://news.ycombinator.com/item?id=21412052 https://news.ycombinator.com/item?id=21412052
- rshnotsecure 7y ago
  Here's the Vietnam server: http://125.212.244.27:9200/_cat/indices http://125.212.244.27:9200/_cat/indices This is the indice you are looking for. 71,000,000 records. yellow open fb_vietnam ChkUhOlHQpO_RozynrZdXA 1 1 71839979 11829285 10.1gb 10.1gb You are right on the 96 hours vs 42 days thing though. It's a lot of work man. No one has volunteered to help. There are a ton of ASNs what can I say lol. I will post about CreditKarma today. Not ProtonMail. Type in "openvpn.creditkarma.com" to Spyse.com please. What do you see? It says it points to a server in Tunisia right? And that server has 10,000 other host names on it almost all from...hnagroup.com? China's really really big private conglomerate correct? Anyway again you are right, but I'm tired, I posted the Vietnam server (at least enough data to confirm amounts although we can debate purpose of cluster which is fascinating). EDIT: Damn it I just realized your account was created new a few hours ago. Can't you use your real name like I do? Maybe email me? NOTE: To your credit I finally posted. Like 1250 words but we'll get there. My wife wants me to move the butcher paper after all :) https://blog.12security.com/ https://blog.12security.com/
  - spamfilter 7y ago
    > This is the indice you are looking for. I'm not looking for any indices. This is another classic fake news ploy - piling one outrageous claim on top of another without ever actually substantiating anything. > Can't you use your real name like I do? Maybe email me? Why? I don't want to chat. I want you to back up your claims the way you made them - publicly. > I finally posted. Like 1250 words. 832 to be precise, and a whole bunch of those making even bigger assertions with even less proof offered. And a whole lot of stuff "tbd" > we'll get there I hope so, because we're not even close yet.
    - rshnotsecure 7y ago
      Lmao this is not a real person. You should triple down and write another angry response. Other than this one which is a little snarky (I apologize but it had to be) I promise I will respond to that one as nicely and patiently as I have the others. Big Hug []

spamfilter 7y ago

I'm sorry, rshnotsecure but until you come up with those 5k words you promised about ProtonMail, CreditKarma and a huge list of others being fronts for spy agencies[1] your posts will only ever be titillating scuttlebutt for me. Last we heard you had the lounge room covered in butcher's paper, plotting it all out and gave your literal word that you'd post that "report" within 96 hours. That was 42 days ago. I have no idea if what you say about FB's server in Vietnam is true and I'm not here to argue with you. The pity is that you post about interesting things. But if making big claims with unshakeable evidence "to come" which never actually arrives is something that we deplore in our politicians and mainstream media, why let it creep in here? [1] https://news.ycombinator.com/item?id=21412052 https://news.ycombinator.com/item?id=21412052

rshnotsecure 7y ago
Here's the Vietnam server: http://125.212.244.27:9200/_cat/indices http://125.212.244.27:9200/_cat/indices This is the indice you are looking for. 71,000,000 records. yellow open fb_vietnam ChkUhOlHQpO_RozynrZdXA 1 1 71839979 11829285 10.1gb 10.1gb You are right on the 96 hours vs 42 days thing though. It's a lot of work man. No one has volunteered to help. There are a ton of ASNs what can I say lol. I will post about CreditKarma today. Not ProtonMail. Type in "openvpn.creditkarma.com" to Spyse.com please. What do you see? It says it points to a server in Tunisia right? And that server has 10,000 other host names on it almost all from...hnagroup.com? China's really really big private conglomerate correct? Anyway again you are right, but I'm tired, I posted the Vietnam server (at least enough data to confirm amounts although we can debate purpose of cluster which is fascinating). EDIT: Damn it I just realized your account was created new a few hours ago. Can't you use your real name like I do? Maybe email me? NOTE: To your credit I finally posted. Like 1250 words but we'll get there. My wife wants me to move the butcher paper after all :) https://blog.12security.com/ https://blog.12security.com/
- spamfilter 7y ago
  > This is the indice you are looking for. I'm not looking for any indices. This is another classic fake news ploy - piling one outrageous claim on top of another without ever actually substantiating anything. > Can't you use your real name like I do? Maybe email me? Why? I don't want to chat. I want you to back up your claims the way you made them - publicly. > I finally posted. Like 1250 words. 832 to be precise, and a whole bunch of those making even bigger assertions with even less proof offered. And a whole lot of stuff "tbd" > we'll get there I hope so, because we're not even close yet.
  - rshnotsecure 7y ago
    Lmao this is not a real person. You should triple down and write another angry response. Other than this one which is a little snarky (I apologize but it had to be) I promise I will respond to that one as nicely and patiently as I have the others. Big Hug []