4 ms·
Facebook really doesn't test anything for security vulnerabilities before pushing to production, do they?
by loceng 13y ago
Facebook really doesn't test anything for security vulnerabilities before pushing to production, do they?
- Argorak 13y agoDo you?
- loceng 13y agoI'm not there yet.
- ffk 13y agoThey most likely do test for security vulnerabilities. However, the attack surface and overall complexity is so large that things will slip by even with the most rigorous testing. For now, the best you can hope for is a layered defense and rigorous dev and ops practices to help minimize the attack surface and reduce the overall damage a single successful attack can achieve.
- Robin_Message 13y agoPutting the user id in the request is obviously wrong, since the owner can looked up from the photo id. Automated testing/fuzzing could find this, but probably better training/practices would be easier to get right and save time/money in the long run.
- bunkat 13y agoI think this is one of the things that Microsoft did a pretty good job with. There is a security process in place that every product goes through for every release. While it still can't catch everything, even the simplest of threat models would have caught a bug like this. While Facebook most likely does do some form of threat modeling for their main site, without a rigid process for all code that goes public you'll run into issues like this that are just as severe. Just because it's a mobile support site for requesting photo removals doesn't mean it is less important surface area in terms of security.
- MichaelApproved 13y agoExactly. As little as possible should be passing through the querystring. Put in the minimum amount in the QS and look the rest up in the DB. If possible, the QS should be signed for an extra layer of protection.
- danielrmay 13y agoI think we can all agree that it's both a very difficult and a very large task to maintain an application with 500 million active users, let alone continue innovation and expansion. Testing can only ever go so far - bugs and vulnerabilities exist everywhere, even in Facebook.
- loceng 13y agoWith the resources they have access to, I'd say there's no real excuse - unless it's not a priority - which could very well be. Privacy only became a priority (which coincides with security) when Facebook started to regularly change people's privacy settings on them.