7 ms·
How I Hacked Facebook’s Secure Files Transfer Service for Employees
- dmak 14y agoWhy does an enterprise level SaaS have such weak security? It is a rookie mistake for a company who emphasizes security.
- fleitz 14y agoI don't think you've worked with many 'enterprise' level software products. Enterprise basically means has a salesforce willing to slog through an RFP.
- bcl 14y agoDepending on user supplied data for password changes? Not a good idea...
- bmohlenhoff 14y agoThe date in the last screenshot (19/3/2012) doesn't match the date in the rest of the images (7/1/2013).
- dmak 14y agoI think he made a whitehat report and probably waited for everything to be fixed before releasing a write up.
- bradleyland 14y agoThe last screenshot is a capture of Windows Media Player playing back a desktop video capture session; basically screenshot inception. The author provides no information on timelines, so it's likely that he found this exploit back in March of 2012, but is just releasing the write-up now.
- mocko 14y agoThis is an example of how a competent cracker (as opposed to a script kiddie) works. He's: 1) Identified a badly protected side entrance to use rather than the front door 2) Painstakingly researched the third party product (similarly one could investigate a third party library used in a bespoke codebase) 3) Figured out the adaptations the target organisation had made to it and guessed some mistakes they'd made 4) Eventually hit on a cookie modification attack made possible by limitations found in that publicly-available codebase. Smart.
- secure 14y agoFor a non-facebook user/employee, can someone please explain which service that is?
- davidradcliffe 14y agoInternal company file sharing.
- duck 14y agoNot just internal, but external as well. Instead of emailing a large file to a vendor, you would send them a link.
- davidradcliffe 14y agoOh true!
- cool-RR 14y agoI'm confused. This looks like an interesting hack, but I don't understand what's going on here, despite reading the post 4 times and watching the video twice. What is this "Password Recovery" page? Is this for emailing a person a reset link to a password? Is it for changing your password? What is the cookie used for? What is the flawed logic in the system? Can anyone explain this more clearly please?
- benmanns 14y agoI think the process was that a user was sent a 'forgot password' link. When they clicked the link, they were redirected to `wmPassupdate.html` with the cookie `referer={base64(email)}` set. Then, when users submit the password update form, the `referer` cookie is used to authenticate them, but it can be trivially generated.
- recuter 14y agotptacek will be shortly along to explain how password reset links are typical and one of the most common mistakes. How you should just "take the hit" (the cost is trivial) and store a randomly generated nounce in your database rather then do shenanigans like encoding user information in the url with secrets and bad cryptography and what not. See? We listen! :)
- lbotos 14y agoDo you have any examples of someone further explaining what you are suggesting? Or if you have time, can you further elaborate on this point? I glanced at the nounce article on wikipedia and if I understand correctly you are suggesting: 1) user creates account (which generates nounce) 2) when password resetting via email auth via nounce. 3) when password is reset regen nounce Is that right? Just trying to better understand what appears to be a good approach to password resets.
- recuter 14y agoHere's a recent post of somebody else channeling tptacek: http://news.ycombinator.com/item?id=4940291 http://news.ycombinator.com/item?id=4940291 I got it from a quick 'password reset' search here, I recall a lot of these discussions, if you're curios click around on a few more results. :)
- mememememememe 14y agoHow did he find this url? Does he work for FB internally?
- Dylan16807 14y agoI like this but what the hell is the problem with base64? 'Still alive these day?'? It's useful for what it does, always has been, never been a security feature.
- CountHackulus 14y agoThe problem is that they're using it for encryption.
- Nitramp 14y agoThey are using it to make sure the value doesn't interfere with the syntax of HTTP headers, i.e. for escaping, not for encryption. That's exactly what base64 is for. They simply have no encryption at all.
- rplnt 14y agoCan email interfere with HTTP headers though? There's no \r\n, ";" or "=" in valid email. Anyway, I have seen sites where it was used as a security measure. Or so the authors thought I guess. Storing login password in url parameter? Seems safe if it is encoded.. But it was years ago.
- hoov 14y agoActually, the '=' character is allowed. [1] [1] http://tools.ietf.org/html/rfc5322#section-3.2.3 http://tools.ietf.org/html/rfc5322#section-3.2.3
- ddunkin 14y agoIt sounds like you confused encoded with encrypted, encoded is no different than plain-text. The encoding is just to get a valid string for the URI (so a password can contain special URI characters) and is instantly reversible.
- rplnt 14y ago
- ing33k 14y agoI understand that facebook has other important things to do ,than create their own file sharing service( for internal purpose ), but I can't stop asking this question, why not create their own thing ?
- 0x0 14y agoWell you pretty much answered your own question, didn't you? Surely it is cheaper to buy an off-the-shelf solution, instead of spending a lot of money on wasting engineering time building and supporting a product that is not core to their mission.
- xxpor 14y agoIt's DRY, applied over the entire industry.
- MichaelGG 14y ago"This Version of ionCube was not vulnerable to a possible decryption" Does he just mean "this version doesn't have a readily available dissassembler yet"? Even if they chose the path of compiling to native code, if you own the box, it can't be that hard to get the code.
- maqr 14y agoI wish he'd gone down this route further. It looks like there's code at the top of the file that "decrypts" (decodes?) the contents of the PHP file. I'd be curious why he felt this wasn't worth reversing. I'm also curious if there's a way to dump 'disassembled' PHP after it's been loaded into the PHP processor. If it's going through eval() at the end, then shouldn't the plain-text source be available in a string somewhere?
- 0x0 14y agoI believe these obfuscators work by forcing you to install a binary-only .so zend extension in php.ini, which intercepts these encoded files. The files themselves should decode to already-halfway-parsed PHP opcodes or so, which is probably injected into the PHP/Zend virtual machine. Figuring out the encoding scheme is probably a lot of boring disassembly work, which in the end just lets you decode a bunch of PHP opcodes which themselves would take a lot of work to make sense of. But perhaps the Vulcan Logic Dumper could help out a little bit. http://derickrethans.nl/projects.html#vld http://derickrethans.nl/projects.html#vld
- elbear 14y agoYes, there is. I've used a PHP extension called evalhook for that.
- jkataria 14y agohuh
- el_duderino 14y agoWindows Media Player? O_o
- kingdm 14y agoWhat's wrong with WMP? :)
- dreamdu5t 14y agoSoon i will publish OAuth bypass in Facebook.com, Cya Next time! hrm?
- deleted 14y ago[deleted]
- denysonique 14y agoHere is another Facebook vulnerability, a more serious one -- a password reset bug: http://chingshiong.blogspot.in/2013/01/facebook-bug-4-password-reset.html http://chingshiong.blogspot.in/2013/01/facebook-bug-4-passwo...