3 ms·

Completely agree. To add, IMO the most valuable application of this exploit would have been to deliver drive-by malware. There are some groups that pay $0.5-3 C

by nikcub 13y ago

Completely agree. To add, IMO the most valuable application of this exploit would have been to deliver drive-by malware. There are some groups that pay $0.5-3 CPM to get their Javascript onto much less targeted web sites. The Yahoo malware would have cost nearly double that. Getting drive-by traffic is one of the most expensive pieces of the puzzle for malware groups. Last time I checked the forums, a thousand visitors was selling for around a dollar, and that isn't even well qualified traffic. Having access to Facebook and over a billion pageviews per hour would be worth millions to any group who is capable of handling that type of volume. If they were smart about it, they could probably get away with it for up to a day (the Yahoo malware was active for a day and they didn't obfuscate it much). Back of the envelope value is around $1M per hour, and that doesn't include the premium for the higher quality of traffic, but does assume you find a way to inject across all the servers and somehow not display it to Facebook internal IPs. A big group with some fresh browser 0day would have loved to get their hands on this.

meowface 13y ago
Considering Facebook's good security team (and Yahoo's notoriously poor one), I suspect that they'd probably catch the malware and perform some sort of emergency action in under an hour. A much more devious attack would be modifying some of the code to silently siphon off login credentials, and grabbing the user database. Then once they were satisfied with that they could go with the malware route.
- nikcub 13y ago
  Facebook must be one of the only large sites that hasn't been hit directly with serving malware, closest I can recall are incidents like this: http://www.f-secure.com/weblog/archives/00002172.html http://www.f-secure.com/weblog/archives/00002172.html
billyhoffman 13y ago
Exactly. Pivoting from the server immediately to the clients by serving malware against the visiting browsers/plugins. Even if large site detects what you are doing quickly and shuts you down, you've leveraged that into controlling thousands of desktop machines

by nikcub 13y ago

meowface 13y ago

Considering Facebook's good security team (and Yahoo's notoriously poor one), I suspect that they'd probably catch the malware and perform some sort of emergency action in under an hour. A much more devious attack would be modifying some of the code to silently siphon off login credentials, and grabbing the user database. Then once they were satisfied with that they could go with the malware route.

nikcub 13y ago
Facebook must be one of the only large sites that hasn't been hit directly with serving malware, closest I can recall are incidents like this: http://www.f-secure.com/weblog/archives/00002172.html http://www.f-secure.com/weblog/archives/00002172.html

billyhoffman 13y ago

Exactly. Pivoting from the server immediately to the clients by serving malware against the visiting browsers/plugins. Even if large site detects what you are doing quickly and shuts you down, you've leveraged that into controlling thousands of desktop machines