6 ms·
That's a pretty amateur mistake for a such an enormous company. Made respect for FB, but c'mon, how'd this slip through? This was a very trivial exploit.
by debt 13y ago
That's a pretty amateur mistake for a such an enormous company. Made respect for FB, but c'mon, how'd this slip through? This was a very trivial exploit.
- RKearney 13y agoNearly every exploit is a "pretty amateur mistake" in hindsight.
- adamnemecek 13y agoNot really, no.
- sillysaurus2 13y agoWould you give some examples of some exploits which you feel weren't exploiting amateur mistakes?
- meowface 13y agohttp://www.exploit-db.com/exploits/28974/ http://www.exploit-db.com/exploits/28974/ Here's one. A use-after-free triggered due to some faulty logic. Mistake? Yes. Amateur mistake? No. Even very experienced C/C++ programmers, such as Microsoft's top devs, may accidentally double-free, or use already-free memory.
- HairyFotr 13y agoDon't static analyzers catch a lot of these bugs these days? (if one can be bothered to configure and use them)
- meowface 13y agoI don't really agree. They made all the effort to put CSRF tokens everywhere, and the vast majority are properly validated, but here there was probably some bug where they assumed the CSRF token validation check was always running, but I guess it wasn't. It's certainly a mistake, but it was probably easy for developers and QA to miss.
- deleted 13y ago[deleted]
- memoryfault 13y agoI disagree with that. It's a get request that is changing state server-side. That is a dead giveaway for a CSRF vulnerability.
- debt 13y agoThey didn't validate the token nor did they make sure the user id was valid for the request; that's two important checks that either weren't there or failed. Seems like they just weren't there as there would have been more failures like this throughout the site. Because those checks weren't there I'd say it was an amateur mistake. Again, if this is the case then the engineer just made an assumption that this request can only be made in particular user state.
- mehwoot 13y agoAlmost every exploit in the wild seems trivial. The hard part is ensuring you don't ever miss one.
- homakov 13y agoyou are right, facebook had lots of CSRF previously, it is obvious they don't take basic security seriously
- wglb 13y agoit is obvious they don't take basic security seriously I would disagree. For a very actively developed web site, it takes very good focus to not trip up. Having a bounty program is an indication to me that they take security seriously. Fixing a security bug in a matter of hours indicates to me that they take security seriously.
- homakov 13y agoAmount and stupidness of bugs in fb says otherwise