15 ms·
Facebook security hole allows viewing of private photos
- DrinkWater 15y agoSeems to be already fixed. The last option described in this tutorial is not there anylonger.
- willvarfar 15y agoReading the thread, it seems that it doesn't work for all accounts and there is speculation it only works if you have us english locale.
- funkeemonk 15y agoCreated a throwaway account to test this against my own account, didn't work even with US English set. There's more to it.
- deleted 15y ago[deleted]
- joelhaasnoot 15y agoMay be a new option that's only being deployed to a small set of users.
- vineetdhanawat 15y agoIt still working for me. Tested few minutes back. I tried this on different proxies as well, so it cannot be region specific. Maybe they are rolling it out (lets say blocking it out) slowly now.
- robertjordan 15y agoExcellent find. You can even access around 25 photos from Mark Zuckerberg's profile. http://imgur.com/a/PrLrB http://imgur.com/a/PrLrB (ps: what a nice photo of them on halloween. very generous too I can see!)
- llambda 15y agoInteresting that those are full-sized. It appeared in the forum post to only be giving access to thumbnail resizes of the original images.
- slig 15y agoApparently, you can change a char in the thumb URL to get the full size image URL.
- llambda 15y agoThat seems to be true only of certain URLs. For instance, if it's all one long, encoded string follow by _a or _s then changing a or s to n produces the full-size image. However some thumbnails aren't formatted in this way and as far as I know can't be (easily) resized to full. Someone please correct me if I'm wrong. Edit: it appears this same char is available in both URI formats I was referring to, so yes, full-size images are exposed.
- vineetdhanawat 15y agoYeah. Someone posted this on 2nd page [quote] right click inspect the image copy url in another window change the 'a' to 'n' (the last one right before jpg) =fullsize original image [/quote]
- TeMPOraL 15y agoTo get the full, full size image try changing from _n to _o. I haven't checked it on the links exposed by discussed method (I'm going to work in a minute), but it's how "Download" link for photos works on normal Facebook photo browser - if you upload a high-resolution picture to Facebook, it's available with _o in the name.
- CWuestefeld 15y agoIf that doesn't prove that FB's developers aren't thinking about security, I don't know what would. Nobody who is in a culture of protecting security would even consider building this.
- tectonic 15y agoOr privacy. The assumption here is that if someone thinks you have an inappropriate photo, you now have no right to privacy?
- deleted 15y ago[deleted]
- judofyr 15y agoI doubt that's way this happened. More likely, the person who implemented the "inappropriate photo"-feature wasn't fully aware of that the "Report"-functionally was enabled for everyone and not just your friends. However, someone had to implement the backend for listing out those photos, and they clearly didn't think of access control, so there's at least something fishy here…
- rplnt 15y agoIt's not the first time either. Very similar breach of privacy happened when they implemented "view my profile as ..." functionality. You gained access to the private data of the user you were simulating.
- ajross 15y agoNo, it's surely just a mistake. No one made an affirmative decision to skip "privacy". What happened is that whoever added the "select more images to block" feature somehow did it in a way that skips the normal access checks. If there's a goof here, it's that the framework they've built apparently doesn't make the privacy controls mandatory. Developers have to remember to "turn them on" by calling an access control predicate or whatnot. That's bad. That's dumb. But it's not malicious.
- 15y ago
- citricsquid 15y agoIt would seem based on the screenshot ("Message x to ask them to remove the photo...") that they must have specific permissions set to cause this to work as I can't replicate on people that I can't message.
- jerfelix 15y agoI disagree. You can message people that you aren't friends with. See the first screen shot ("add her as a friend or send her a message"). I think the reason it only works on some profiles it that perhaps the profile pictures are the only ones that it will show you. And some people only have one profile photo. (This is an untested theory / guess.)
- synnik 15y agoWhether or not non-friends can message you is a privacy setting.
- funkeemonk 15y agoTested this theory against my account using another throwaway one. My real account has several profile pictures and the exploit didn't work.
- einhverfr 15y agoFacebook is an excellent personal marketing tool. However, I think at this point you'd have to be a fool to put material on it you want to be private. Of course, what PT Barnum said....
- baha_man 15y ago"Of course, what PT Barnum said..." Or possibly didn't say: http://en.wikipedia.org/wiki/Theres_a_sucker_born_every_minute http://en.wikipedia.org/wiki/Theres_a_sucker_born_every_minu...
- rodion_89 15y agoIt looks like HN removed the apostrophe so here is a bit.ly version that works. http://bit.ly/kyYCxk http://bit.ly/kyYCxk
- Archio 15y agoThis isn't even a security hole, it's a complete security disaster. Did they even think through the process for five minutes before they built that? I mean, there aren't even any hacks involved. Nice find.
- tantalor 15y ago> there aren't even any hacks involved I doubt law enforcement would see it that way. Downloading photos with this method is not much different than guessing somebody's email or voicemail password; you're accessing something you're not supposed to. See 18 U.S.C. § 1030(a)(2)(C) and § 2701.
- Archio 15y agoWell, the question is, how far does that go? If I put up photos on a public web server intending them to be private, is that still legal?
- dangrossman 15y agoIt goes as far as is reasonable. The law gets interpreted in a court of law by human beings that make decisions about whether a reasonable person would expect that to be private and the intent of the person that found the images anyway.
- tantalor 15y agoHere's a good writeup of the state laws, http://law.jrank.org/pages/11804/Computer-Crimes.html http://law.jrank.org/pages/11804/Computer-Crimes.html It is not enough for purposes of these laws to accidently or unintentionally wander into areas on the internet where valuable or secure information may reside. If one enters such an area using computers or computer technology, his/her intent must be to steal, destroy or defraud to be found guilty of a crime. For example, David Kernell was convicted of "misdemeanor computer intrusion"[1] for accessing Sarah Palin's Yahoo! email. [1] http://www.esecurityplanet.com/headlines/article.php/3879756/Palin-Email-Hacker-Convicted-on-Two-Charges.htm http://www.esecurityplanet.com/headlines/article.php/3879756...
- ianhawes 15y agoThis is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?
- Archio 15y agoI think it's a stretch to call this "just" a mistake. First of all, there isn't any malicious code that has to be run to execute it, it's a simple as clicking a few buttons in the UI. Secondly, Facebook is a site with hundreds of millions of users managing billions of private photos. With the amount of revenue & number of developers they have, it's inexcusable that they can't think through a simple process like this without considering what happens if two users aren't friends. Granted, they're probably not "trying" to undermine privacy. But they're doing a very poor job at maintaining it.
- nyellin 15y agoI'm downvoting you for saying I think it's a stretch to call this a mistake If it wasn't on purpose, it was a mistake. Period. It might be inexcusable, as you later pointed out, but it was still unintentional. Everyone likes to hate on Facebook. If this was a YC startup, I suspect people would be more forgiving.
- skeptical 15y agoaammm... you omited the word 'just' which archio stressed. Sure, if you take away THE important word of a sentence, then you might as well downvote it. 'a mistake' puts this at the same level of seriousness as other problems. This is at least a big mistake.
- nyellin 15y agoI copied and pasted from the original comment. The word "just" was added later.
- icebraining 15y ago
- kristopolous 15y agoGeneral form appears to be as follows: http://www.facebook.com/ajax/report/social.php? __a=1& __d=1& attach_additional_photos=1& cid=((FBID))& content_type=0& h=((HASH BASED ON YOUR ACCOUNT))& phase=6& report_id=1& rid=((FBID)) After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy. This issue is probably going to make mainstream news by noon.
- hoolash 15y agoHow would this be sent? entering into the address bar returns a blank page, and no change on profile pages.
- kristopolous 15y agoSorry just got up ... anyway ... I got it through Firebug and was able to reproduce it in a FireFox Tab, so I assume it was a GET, although it may have been a POST; I didn't cURL the URL from outside the browser though; I'm sure you need cookies.
- deleted 15y ago[deleted]
- kurtgodel 15y agoWhat is the "hash"? An md5 of username? Or what?
- noname123 15y agoI tried to follow this url format by using Chrome Developer toolbar after clicking on "report this photo" of a non-private photo to extract my account hash id, rid and cid of the interested person. It's a GET according to Developer tool. I get this however, for (;;);{"__ar":1,"error":1357006,"errorSummary":"Don't have Permission","errorDescription":"You don't have sufficient permissions to do that.","payload":null} Anyone know if it's already patched?
- 15y ago
- djbender 15y agostill works.
- hannibalhorn 15y agoFunny how something like this is originally posted on a body building forum. I think the first reports of the recent Penn State scandal were posted there too (around a year ago.) Who would have thought that's where you'd first find such things?
- pud 15y agoBodybuilding.com started as a forum about bodybuilding, but over the years morphed into a large general message board with all sorts of members. Behold, "misc," the /b/ of bodybuilding.com: http://forum.bodybuilding.com/forumdisplay.php?f=19 http://forum.bodybuilding.com/forumdisplay.php?f=19
- deleted 15y ago[deleted]
- driverdan 15y agoThis was posted in Misc. Misc has nothing to do with bodybuilding, it just happens to be part of a bodybuilding forum. As pud mentioned, they're basically /b/tards.
- tuppy 15y agoThe Misc is probably my favorite general forum on the internet. Suprisingly-high level of discourse and genial atmosphere for a forum dedicated to lifting weights. HN would be pretty impressed with the number of engineers and entrepreneurs there as well :)
- pasbesoin 15y agoSeriously, FB, do you have no QA whatsoever? I wonder whether this is limited to photos in the profile album, or whatever it is called, these days. EDIT: I'll add this suggestion that I've made before, since you're going to have a LOT of people wanting to delete photos, if this problem proves to be significant. Delegate someone to spend a few hours writing a routine that will replace a cached photo with an identically sized, all white (or black, blue, whatever), no metadata generated image. So, you don't have to rebuild your image caches in order to ensure that a photo is really gone (well, except for the fact that it once existed, as demonstrated by the working URL and white image). I've read the excuse made in the past that aggressive, large, integrated image caches made actual photo deletion "not an option". As long as you can overwrite existing bits in place, this should solve that. (Although I don't know about all the tagging you've now since overlaid onto the images.)
- vaksel 15y agoisn't there another problem with facebook, where none of your photos are ever deleted and can be accessed by the direct url at any time?
- pasbesoin 15y agoI haven't kept up, but IIRC that used to be the case. And that's what I'm addressing. A few years ago, I believe, they explained that they generate these ginormous image caches where, IIRC, individual images are not distinct files. My point is, regardless, if you can find the image (and its extent), and if the cache data are still write-able, then overlay a generated "blank" image onto the cached image, in place. You still have some data leakage, in that the working URL confirms that there was an image having that URL. But for most cases, I believe this would suffice. I guess they'd also have to track down and overwrite the various thumbnail versions, but if their systems can already find these in the course of their normal work, this shouldn't be a problem. As for overlaid tag data and whatnot, I'm not sure what to suggest. At a first pass, I'd suggest just deleting (or "offlining" or whatever, given that FB apparently never really deletes anything) that data. But I don't know what continuing dependencies that might break.) EDIT: I should add that I don't know whether/how such image caches are replicated. And perpetuating such an overwrite against multiple replications might not be easy / something the existing design supports. Nonetheless, I think it's something they should support. At a minimum, when a user really wants to delete an image, then overwrite its segment of whatever image cache file with a "blank" equivalent. Although... then you get into what may be legally required and/or prudent, from FB's perspective, to retain. I'll stick to the simplistic user perspective: When I say delete, I mean delete.
- Zhenya 15y agoBoy, I wonder what the FTC will say about this...
- digitalsushi 15y agoDon't do it, kids. You'll find photos of that girl you pined for 2 years after you never made your move and she's way more fun and in way better shape than you ever guessed. It's rough to ruin the fantasy, but torture to augment it.
- kmfrk 15y agoThis is how many days after the FTC settlement?
- tzury 15y agosomeone [1] pulled this trick on Zuck's account [2] 1. http://twitter.com/#!/flyosity/status/144065873743839233 http://twitter.com/#!/flyosity/status/144065873743839233 2. http://imgur.com/a/PrLrB http://imgur.com/a/PrLrB
- brlewis 15y agoOne of the images is of the last paragraph of the FTC page about Facebook where readers are invited to Like the FTC on Facebook. Background: http://news.ycombinator.com/item?id=3291909 http://news.ycombinator.com/item?id=3291909
- jdp23 15y agoI wonder if the FTC will follow through on the settlement and fine Facebook $10,000 for each violation? There's a dozen or so photos of Zuck, so that's $120K already ...
- bilalhusain 15y agohold your horses; the tweet is 48 minutes ago where as robertjordan has a comment on this very page with a timestamp of 4 hrs ago at this moment. edit: imgur album was also created 4 hrs ago
- balsam 15y agoi'd like to see these tagged. (seriously) anybody knows what they are drinking in that last pic? The bottle looks interesting.
- tptacek 15y agoLooks like Johnnie Walker Blue. I'm a little skeezed out at having looked at these photos at all, but "name that liquor" will apparently (in borderline cases like this) trump my principles.
- corin_ 15y agoYep it is, the drink of choice for people who don't want a particularly cheap bottle and pay for label not taste.
- simondlr 15y agoMoving fast and breaking things.
- mrgreenfur 15y agoUgh, JW blue
- lobster45 15y agoThis is why I never post private pictures on Facebook
- ricksta 15y agoI wonder how people discover this
- mkjones 15y agoThis was indeed a bug, and shouldn't work any more. We turned off the system that lets you report content through this flow (and thus made this bug's code inaccessible) as soon as we became aware of the issue. In the future, if you find a security / privacy bug on Facebook, feel free to report it via our whitehat program, which will get things looked at more quickly than random blog posts. You can get credit for the find and even make money with bug-bounty payouts: http://www.facebook.com/whitehat/ http://www.facebook.com/whitehat/. For what it's worth, a few people were alluding to this meaning that we don't check privacy by default. In fact we do have a pretty robust default-deny system for running privacy checks. This was an edge case where it was forced to work in a way that was incorrect. (I work at Facebook, but not on this system.)
- soult 15y agoIt is great that you have a page specifically for reporting security issues. For some companies I had to resort to reporting security issues to the main contact address where it landed at some first-level support guy's desk who had no idea what to do and in the end I gave up and the security hole stayed open. One thing though: Your bounty of $500 is quite low. I bet this whole incident did/does a lot more damage than that. And to be honest, if I had the choice between $500 and trolling Mark Zuckerberg by posting his private photos album online, I would probably chose the latter option (sans the posting a howto on a forum part). Disclaimer: I am not a security researcher, I don't even look for vulnerabilities. I just sometimes stumble upon bugs and get curious what other side-effects this bug might cause.
- mkjones 15y agoGlad you like it! $500 is actually just the base bounty - I've seen payouts for quite a bit more depending on how nasty the bug is. At least for me personally, it's not the posting of one person's private photos that is most frustrating - it's public posting of repro instructions so that script kiddies can exploit a bug. That just seems irresponsible.
- corin_ 15y agoIt's still possible to make the request using: http://www.facebook.com/ajax/report/social.php?__a=1&__d=1&attach_additional_photos=1&cid=XX&content_type=0&h=YY&phase=6&report_id=1&rid=XX Where XX and YY can be found by watching the net request made when clicking the initial Report/Block button. That said, I'm not sure if it is returning private photos, or just photos that are public - possibly you guys have fixed it on this side, not just the front end having links to it, but figured I'd mention it in case not.
- dpeck 15y agoThe more often this happens, maybe the more normal people will understand that anything put online should be considered to be public. The illusion of the walled garden eventually comes down, either through a vulnerability, policy change, or simply user error.
- blob4000 15y agomirror to exploit instructions + pictures http://www.multiupload.com/RC184ELRZ9 http://www.multiupload.com/RC184ELRZ9