4 ms·

The engineer's computer was compromised using a real zero-day exploit targeting an undisclosed piece of software. What the diddly ding dong is Facebook doing w

by eksith 14y ago

The engineer's computer was compromised using a real zero-day exploit targeting an undisclosed piece of software. What the diddly ding dong is Facebook doing with real 0-day exploits (besides using them in fire drills)? More importantly HOW did they get their hands on 0-day exploits? And what other exploits do they have/buy/finagle? Is it on a regular basis?

CGamesPlay 14y ago
(I work at Facebook but don't know anything about the event in question or if this post is accurate) I suspect it wasn't actually a "0-day" in that sense, but rather a disclosed but unpatched vulnerability, and described as "a real 0-day exploit" in the article because of the typical reduced fidelity of press articles.
- eksith 14y ago
  Ah! See, that makes much more sense, but I hope this isn't spin. ;) So then next question, how come the vulnerability was unpatched?
  - w-ll 14y ago
    Because it was all staged?
    - eksith 14y ago
      But then what about this : "The engineer's computer was compromised using a real zero-day exploit targeting an undisclosed piece of software. (Facebook promptly reported it to the developer.) It allowed a "red team" composed of current and former Facebook employees to access the company's code production environment. (The affected software developer was notified before the drill was disclosed to the rest of the Facebook employees)." Does that mean they used the discovery of the vulnerability as an opportunity to create the drill (as a "might as well use this" scenario) or was the drill planned with the 0-day and then the developer was notified? Which came first here, the vulnerability or the plan for the excercise? I would imagine priority would be to patch the system rather than plan a drill, no?
      - lgeek 14y ago
        They could have planned out a drill and then waited for the first vulnerability they could exploit. Edit: mkjones says they bought the 0-day: https://news.ycombinator.com/item?id=5199757 https://news.ycombinator.com/item?id=5199757
        chris_wot 14y ago
        All very nice, but the article clearly says that they disclosed the backdoor to the developer after the drill.
tptacek 14y ago
Exactly how hard do you think it is to get your hands on an exploit for an unpatched vulnerability?
- sliverstorm 14y ago
  Clearly, only the top brass in the Kremlin could ever get their hands on them. ;)
mcpherrinm 14y ago
How did they get their hands on an 0day? Probably found it. It isn't like you have to buy plutonium from some Libyan nationalists -- Facebook has plenty of smart engineers who can audit the software they use. I've seen 0days found by engineers at other tech companies, so I find it likely that somebody at Facebook could run across one if they tried.
chris_wot 14y ago
I'm trying really hard not to read your post in Ned Flanders' voice. But in terms of 0-day exploits, I believe there is a ready market for them if you know where to look, and are willing to pay.
- eksith 14y ago
  This is what worries, me. Facebook is buying up exploits? I know there's a steady supply, but without knowing what software they're referring to or what the exact nature of the exploit was, it's hard to know what to think. Privilege escalation, arbritary code execution or what? Was it in the OS or some application they themselves developed? If it's the OS, then that would be really disturbing. P.S. I have a mustache. Enjoy! :)
trotsky 14y ago
Trustwave was the outside party running the penetration test. 0-days are commonly used by pentesters, and are available for purchase by subscription as well as one offs that are made available via mailing lists etc. For example: https://www.immunityinc.com/canvas-cep.shtml https://www.immunityinc.com/canvas-cep.shtml This is standard practice for the industry and quite common. But do note that not all 0-days are created equal: a 0-day that effects 1000 users is 1000x the significance of one that effects only one user (with some notable exceptions). Also realize that 0-day is often used misleadingly - anything that was first used in the wild is a 0-day, even if that event was months ago, the vendor has been informed, and crucially - even if a patch has been issued by the vendor. Pentest firms often oversell their "0-days" in an effort to appear more advanced to their clients.

by eksith 14y ago

CGamesPlay 14y ago

(I work at Facebook but don't know anything about the event in question or if this post is accurate) I suspect it wasn't actually a "0-day" in that sense, but rather a disclosed but unpatched vulnerability, and described as "a real 0-day exploit" in the article because of the typical reduced fidelity of press articles.

eksith 14y ago
Ah! See, that makes much more sense, but I hope this isn't spin. ;) So then next question, how come the vulnerability was unpatched?
- w-ll 14y ago
  Because it was all staged?
  - eksith 14y ago
    But then what about this : "The engineer's computer was compromised using a real zero-day exploit targeting an undisclosed piece of software. (Facebook promptly reported it to the developer.) It allowed a "red team" composed of current and former Facebook employees to access the company's code production environment. (The affected software developer was notified before the drill was disclosed to the rest of the Facebook employees)." Does that mean they used the discovery of the vulnerability as an opportunity to create the drill (as a "might as well use this" scenario) or was the drill planned with the 0-day and then the developer was notified? Which came first here, the vulnerability or the plan for the excercise? I would imagine priority would be to patch the system rather than plan a drill, no?
    - lgeek 14y ago
      They could have planned out a drill and then waited for the first vulnerability they could exploit. Edit: mkjones says they bought the 0-day: https://news.ycombinator.com/item?id=5199757 https://news.ycombinator.com/item?id=5199757
      - chris_wot 14y ago
        All very nice, but the article clearly says that they disclosed the backdoor to the developer after the drill.

tptacek 14y ago

Exactly how hard do you think it is to get your hands on an exploit for an unpatched vulnerability?

sliverstorm 14y ago
Clearly, only the top brass in the Kremlin could ever get their hands on them. ;)

mcpherrinm 14y ago

How did they get their hands on an 0day? Probably found it. It isn't like you have to buy plutonium from some Libyan nationalists -- Facebook has plenty of smart engineers who can audit the software they use. I've seen 0days found by engineers at other tech companies, so I find it likely that somebody at Facebook could run across one if they tried.

chris_wot 14y ago

I'm trying really hard not to read your post in Ned Flanders' voice. But in terms of 0-day exploits, I believe there is a ready market for them if you know where to look, and are willing to pay.

eksith 14y ago
This is what worries, me. Facebook is buying up exploits? I know there's a steady supply, but without knowing what software they're referring to or what the exact nature of the exploit was, it's hard to know what to think. Privilege escalation, arbritary code execution or what? Was it in the OS or some application they themselves developed? If it's the OS, then that would be really disturbing. P.S. I have a mustache. Enjoy! :)

trotsky 14y ago

Trustwave was the outside party running the penetration test. 0-days are commonly used by pentesters, and are available for purchase by subscription as well as one offs that are made available via mailing lists etc. For example: https://www.immunityinc.com/canvas-cep.shtml https://www.immunityinc.com/canvas-cep.shtml This is standard practice for the industry and quite common. But do note that not all 0-days are created equal: a 0-day that effects 1000 users is 1000x the significance of one that effects only one user (with some notable exceptions). Also realize that 0-day is often used misleadingly - anything that was first used in the wild is a 0-day, even if that event was months ago, the vendor has been informed, and crucially - even if a patch has been issued by the vendor. Pentest firms often oversell their "0-days" in an effort to appear more advanced to their clients.