5 ms·

How to cause utter chaos on Facebook

33 points by thomasdavis 15y ago

thomasdavis 15y ago
Makes a vulgar post on a users wall, if the user clicks "Remove this app" it then post it to all your friends walls. Reddits reaction thus far http://www.reddit.com/r/reddit.com/search?q=nicole+santos http://www.reddit.com/r/reddit.com/search?q=nicole+santos Edit: I think facebook has already taken it down, it lasted about 30 minutes.
- guywithabike 15y ago
  It was Dropbox that took down the file, though I bet it was taken down by some sort of automatic hotlinking protection system.
  - thomasdavis 15y ago
    The Dropbox link went down quite fast, it was mirrored by another site nearly instantly and the hack remained in working condition. Then I'm guessing Facebook took down the App and deleted all the comments that were spread.
kooshball 15y ago
Can someone post an image of what the "Remove this app" picture actually looks like? does it show as part of the newsfeed?
- oomkiller 15y ago
  http://i.imgur.com/wljHt.png http://i.imgur.com/wljHt.png Seems to be a decent example.
bhickey 15y ago
Great, you found a script injection. However, I think you misunderstand "Hacker News"
- thomasdavis 15y ago
  Wasn't me and I don't understand this comment.
rottyguy 15y ago
seems like a better way to cause a dns attack on the file hosters machine no? better title: dns attack from facebook.
program 15y ago
It all began when a user pasted the value of the jsText variable in the address bar. The script create a new script DOM element and append it to head injecting the malicious links (so that there is no more need to run the bookmarklet-like link.) The problem here is that the (old) Facebook prompt_page.php page: http://www.facebook.com/connect/prompt_feed.php http://www.facebook.com/connect/prompt_feed.php doesn't sanitize feed_info[action_links][0][href] allowing javascript: links.
wilshire461 15y ago
It seems as though she is more the victim of some asshole that may or may not know her, that is now trying to extract some revenge by making her life a miserable hell while this mess gets sorted out.

33 points by thomasdavis 15y ago

Makes a vulgar post on a users wall, if the user clicks "Remove this app" it then post it to all your friends walls. Reddits reaction thus far http://www.reddit.com/r/reddit.com/search?q=nicole+santos http://www.reddit.com/r/reddit.com/search?q=nicole+santos Edit: I think facebook has already taken it down, it lasted about 30 minutes.

guywithabike 15y ago
It was Dropbox that took down the file, though I bet it was taken down by some sort of automatic hotlinking protection system.
- thomasdavis 15y ago
  The Dropbox link went down quite fast, it was mirrored by another site nearly instantly and the hack remained in working condition. Then I'm guessing Facebook took down the App and deleted all the comments that were spread.

kooshball 15y ago

Can someone post an image of what the "Remove this app" picture actually looks like? does it show as part of the newsfeed?

oomkiller 15y ago
http://i.imgur.com/wljHt.png http://i.imgur.com/wljHt.png Seems to be a decent example.

bhickey 15y ago

Great, you found a script injection. However, I think you misunderstand "Hacker News"

thomasdavis 15y ago
Wasn't me and I don't understand this comment.

rottyguy 15y ago

seems like a better way to cause a dns attack on the file hosters machine no? better title: dns attack from facebook.

program 15y ago

It all began when a user pasted the value of the jsText variable in the address bar. The script create a new script DOM element and append it to head injecting the malicious links (so that there is no more need to run the bookmarklet-like link.) The problem here is that the (old) Facebook prompt_page.php page: http://www.facebook.com/connect/prompt_feed.php http://www.facebook.com/connect/prompt_feed.php doesn't sanitize feed_info[action_links][0][href] allowing javascript: links.

wilshire461 15y ago

It seems as though she is more the victim of some asshole that may or may not know her, that is now trying to extract some revenge by making her life a miserable hell while this mess gets sorted out.