Re:How I Hacked Facebook and Found Someone's Backdoor Script
by dkopi on Friday April 22, 2016 @04:29AM
(#11547764)
"I'm hoping you did actually have a proxy in front of it and Orange just didn't catch that."
That sounds a lot more reasonable than actually having the private key on each individual server.
Re:How I Hacked Facebook and Found Someone's Backdoor Script
by spicyj on Thursday April 21, 2016 @08:12PM
(#11546228)
> From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron.
The article claims those are tfbnw.net, not fb.com.
Re:How I Hacked Facebook and Found Someone's Backdoor Script
by brians on Thursday April 21, 2016 @06:37PM
(#11545824)
Figure that was probably a CDN, and you don't know the origin configuration
Re:How I Hacked Facebook and Found Someone's Backdoor Script
by peterwwillis on Friday April 22, 2016 @02:16PM
(#11551276)
I hope it was. But if it and the other services Orange found are just random internet-facing appliances, it's unlikely they would configure a CDN to get access, because CDNs are for public traffic typically. Nobody uses a CDN to open their outlook web mail to the Internet, for example. But they might have had a regular SSL proxy in front.... maybe.
Re:How I Hacked Facebook and Found Someone's Backdoor Script
by onewaystreet on Thursday April 21, 2016 @06:14PM
(#11545697)
> no protection against data exfiltration
That's a big assumption
Re:How I Hacked Facebook and Found Someone's Backdoor Script
by Someone1234 on Thursday April 21, 2016 @06:16PM
(#11545716)
Since the article exfiltrated data, no, it is a fact.
Re:How I Hacked Facebook and Found Someone's Backdoor Script
by onewaystreet on Thursday April 21, 2016 @06:22PM
(#11545751)
If downloading any data from a hacked server counts as exfiltration then everyone could be said to have no protection against data exfiltration.
"Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access."
From the write-up:
> After checking the browser, the SSL certificate of files.fb.com was * .fb.com …
You left a wildcard cert on this random internet-facing unaudited 3rd party linux box with no protection against data exfiltration, or an HTTPS proxy in front of it, or anything? I know it's not as critical as facebook.com, but this is still bad. Priv escalation CVEs for Linux come out like every month.
At the very least, using this cert, anyone could run a MITM on any * .fb.com service and compromise without ever breaking in. From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron. I'm hoping you did actually have a proxy in front of it and Orange just didn't catch that.