6 ms·
I Can Detect Your Facebook Username, Using W3C Standard
- Whitespace 14y agoDidn't work for me although I was logged in to facebook. Chrome 25.0.1364.99
- throwaway54-762 14y agoSame, chrome 25.0.1364.97.
- homakov 14y agothis happens when facebook is "down" or when u set bad timeout /https. Can you trace urls you get ? Https enforcement?
- homakov 14y agoguys, my bad - typo :(
- throwaway54-762 14y agoWFM now =)
- gee_totes 14y agoBut can't you also find someone's username by hiding the facepile plugin from the user, waiting for it to load, then pulling the username once it's loaded?
- homakov 14y agoNot "pulling", detecting. Vuln is not severe but it is still fun!
- ansman 14y agoIsn't this the same guy who discovered the mass assignment bug in Rails last year?
- justin_vanw 14y agoCool story, followed link, tried example, it doesn't work at all. Either Facebook fixed it, or it was crap.
- deleted 14y ago[deleted]
- web007 14y agoIt only shows what FB pages have been visited - If I go to /egor.homakov and then type that in for my match string, it says that's my username. How is this different from reading link colors / setting a:visited behaviors to see where you've been? (I don't remember if browsers have fixed that "bug" or not, it's an old exploit.)
- mauricioc 14y agoThe :visited privacy-related leak is fixed in Firefox, at least: see http://dbaron.org/mozilla/visited-privacy http://dbaron.org/mozilla/visited-privacy and https://bugzilla.mozilla.org/show_bug.cgi?id=147777 https://bugzilla.mozilla.org/show_bug.cgi?id=147777 for sources.
- homakov 14y agoha, there is a NOT SAFE FOR WORK demo i made for :visited :D http://homakov.github.com/ex.html http://homakov.github.com/ex.html
- homakov 14y ago> How is this different from reading link colors / setting a:visited behaviors to see where you've been? this is completely different thing. I don't read your visited links, i read your current URL in window. and they fixed it, I recall.
- homakov 14y agoi had a typo in PoC, now it clearly works
- slig 14y agoFWIW, it's still working.
- homakov 14y agoit is buggy, but conception is working. the thing is THERE IS NO WAY TO FIX IT. Because it's standard. and this is the fun part.
- peterbraden 14y agonot true - it's a timing attack right? There's nothing in the spec that says they can't spoof a timing delay?
- blakel 14y agoIt's not a timing attack. The behavior of the browser, after appending an '#' to location.href, is different depending on the value of the current URL. The state of the browser after making such a change gives you information about what the current URL was before making the change. The information it gives you is whether or not you only appended '#.* ' to the current URL. Normally, this information is only available in this context if the current URL follows the code origin policies of the currently executing code. In most browsers, this means you can only look at current URLs if they are in the same domain as the executing code. The article shows code that exploits this to try to guess your Facebook username. This is interesting 1) because it allows for brute force attacks to gain potentially sensitive information and 2) this may cause new discoveries that could make this more efficient or that expand what is possible and 3) because this behavior is as designed.
- homakov 14y agoyes i fully agree with your points but it's still two vulns 1) detecting URL by assigning hash + onload (iframe) 2) detecting URL by assigning hash + timing of history (window) i just made it work for both frame/window this way
- 14y ago
- aristus 14y agowww.facebook.com/whitehat/report/ First hit when you Google for [facebook report vulnerability]
- homakov 14y ago1) it's minor but still fun 2) facebook is only showcase, it's basically UNFIXABLE
- homakov 14y agoThere was a typo in my code! Sorry, now updating
- homakov 14y agoyou can check only one username at time now. there was some caching / navigation bug which i don't have time to polish :( also default timeout = 9000 now! Please test http://homakov.github.com/fbdetect.html http://homakov.github.com/fbdetect.html sorry again for buggy PoC!
- heroic 14y agoLOL, i entered my handle and it says I am not my handle!
- Qantourisc 14y agoIsn't it time browser implement a "safe" mode: - Sharing cookies between tabs? Nope, unless you personally opened it another tab, and expires as soon as you type in a new url. - Access or url on a different domain ... maybe, but certainly not to localhost. - Font access ? No - Plugin listing ? No - Whatever the hell I don't know about: No. Then either allow the user to whitelist the site, and/or allow certain parts. Would it be easy for the user? No. Would we weed out a lot of issues? At least a few !
- lucian1900 14y agoThat would break way too many things to be acceptable. Web technologies are stupidly backwards compatible.
- Qantourisc 14y agoI know ... but if you are going to be backwards compatible with security flaws/designs ... cheese ... then it's never ever going to get fixed, and I'll stop bothering making web-apps: no security future!
- yason 14y agoIt didn't work but I know why: I use a different browser for Facebook—not because of these hacks but because Facebook itself is more invasive than any of these tricks. I don't want to accidentally connect what I browser with Facebook. I have a separate browser icon that launches: google-chrome --user-data-dir=/home/myaccount/.config/facebook-chrome And that launches directly to Facebook. I keep Facebook stuff nicely contained in that browser. I mostly just follow links out of Facebook. The real Chrome never even knows that I'm on Facebook.
- homakov 14y agoyou are paranoid a bit :) do you have browser for each site?
- mich41 14y agoNo, he has a browser for Facebook.
- yuvadam 14y agoI also hope you use rule-based blocking on any third party crap Facebook might be serving - i.e. tracking - you on different websites by matching your IP.
- statictype 14y agoI use an Incognito window for Facebook and login each time I want to see something. Is what you're doing more secure than that?
- yason 14y agoI did that at some point but this is more convenient. My Facebook browser has me logged in all the time, I just need to launch it to check Facebook.
- curiousdannii 14y agoI don't try to prevent Facebook from figuring out who I am or what I do. They should have a huge amount of info about me, but their ads are still entirely irrelevant.
- splitbrain 14y agoOkay, maybe I was stupid but I couldn't find the link to the demo in the article. Author posted it somewhere here in the comments: http://homakov.github.com/fbdetect.html http://homakov.github.com/fbdetect.html So all this does is to check if my username matches with some preexisting username. Its no way you can detect my username if you don't already know it. Also even after I gave the demo my username, chrome simply blocked a popup and the whole thing failed... Either I don't get it or this is a lot less impressive than the title suggests.
- homakov 14y ago> chrome simply blocked a popup blocked is ok, just wait. i said 'detect'. you can check against predefined 10-50 list of friends
- stephengillie 14y agoThis doesn't actually work. After allowing the popup, it just confirmed whatever username I put into the text box.
- p4bl0 14y agoSame for me, but I also note that whatever I put in the dialog, I get redirected to my actual Facebook page. Also, I had to allow popups.
- Dunnorandom 14y agohttps://www.facebook.com/profile.php https://www.facebook.com/profile.php always links to your actual Facebook page, so being redirected there doesn't mean the PoC is working.
- p4bl0 14y agoI know I was implying it wasn't.
- klapinat0r 14y agoFrom what I gather, it would be useful for targeted attacks - bruteforce wouldn't really be viable if your handle takes 50 years to generate in javascript? Not that it's hard to get people to click links, but am I missing what's so "nifty" about this vuln?
- bhushanmore 14y agovery nice
- bhushanmore 14y agovery nice
- daledavies 14y agoHow much does it matter if you know my username? As long as you don't know my password right?