Re:Facebook CSRF leading to full account takeover (fixed)
by bdcravens on Sunday October 20, 2013 @12:19AM
(#6578921)
Should the title be updated to reflect that this is 2+ months old? After all, the fix was put in place in a couple of hours. This isn't a current bug, but rather, an excellent post-mortem, but the title suggests present tense.
Re:Facebook CSRF leading to full account takeover (fixed)
by ParkerK on Sunday October 20, 2013 @12:38AM
(#6578955)
Most responsible disclosure is normally posted about sooner though. I think what the OP meant is that waiting 2 months later, and then giving the post this title, makes it seem as though it was a more recent bug
Re:Facebook CSRF leading to full account takeover (fixed)
by Miyamoto on Sunday October 20, 2013 @01:02AM
(#6578988)
"Post-mortem" is usually appended to titles for solved vulnerabilities, although this was 2 months ago. Maybe just timestamp it? e.g. "Facebook CSRF leading to full account takeover (Post-mortem, August 2013)"
Re:Facebook CSRF leading to full account takeover (fixed)
by lambada on Sunday October 20, 2013 @06:44AM
(#6579499)
That would imply that the Post-Mortem itself was written in August 2013, which would probably get far fewer clicks as people assume they've read about the vulnerability before.
Re:Facebook CSRF leading to full account takeover (fixed)
by rmc on Sunday October 20, 2013 @04:56PM
(#6581440)
Oh I agree. I was directing my comment at the comment I replied to, which was bemoaning that this wasn't a current bug. It was like they were complaining that responsible disclosure wasn't followed.
Re:Facebook CSRF leading to full account takeover (fixed)
by bdcravens on Monday October 21, 2013 @12:39PM
(#6586625)
I wasn't at all suggesting disclosing a bug before it's fixed. The write-up was great, the disclosure correct. I was merely saying that the HN title should reflect the current state of affairs.
Re:Facebook CSRF leading to full account takeover (fixed)
by tomschlick on Sunday October 20, 2013 @03:50AM
(#6579232)
Congrats. This is exactly how responsible disclosure is supposed to work. You spend valuable time looking for holes and when you find one they fix it quickly and compensate you for your trouble.
Re:Facebook CSRF leading to full account takeover (fixed)
by TomAnthony on Sunday October 20, 2013 @08:44AM
(#6579725)
Were you able to do this all with the dummy accounts that Facebook provides for the Bug Bounty program or did any steps require a genuine account? Just curious as I always wonder whether there are bugs that affect genuine accounts and not dummy accounts or vice-versa.
Re:Facebook CSRF leading to full account takeover (fixed)
by brianshaler on Sunday October 20, 2013 @01:17AM
(#6579005)
He'd probably be better off staying where he is and courting customers in the US and UK. The combination of a low cost of living and a metropolitan income (or as close as possible) is a splendid combination.
Re:Facebook CSRF leading to full account takeover (fixed)
by objclxt on Saturday October 19, 2013 @11:13PM
(#6578819)
Given the seriousness, I would hope it is in the five figures (Facebook don't go into details about rewards, but a comparable exploit for a Google Account would net you at least $10k).
Re:Facebook CSRF leading to full account takeover (fixed)
by debt on Saturday October 19, 2013 @11:05PM
(#6578807)
That's a pretty amateur mistake for a such an enormous company. Made respect for FB, but c'mon, how'd this slip through? This was a very trivial exploit.
Re:Facebook CSRF leading to full account takeover (fixed)
by meowface on Saturday October 19, 2013 @11:31PM
(#6578843)
I don't really agree. They made all the effort to put CSRF tokens everywhere, and the vast majority are properly validated, but here there was probably some bug where they assumed the CSRF token validation check was always running, but I guess it wasn't.
It's certainly a mistake, but it was probably easy for developers and QA to miss.
Re:Facebook CSRF leading to full account takeover (fixed)
by debt on Sunday October 20, 2013 @02:45PM
(#6580941)
They didn't validate the token nor did they make sure the user id was valid for the request; that's two important checks that either weren't there or failed. Seems like they just weren't there as there would have been more failures like this throughout the site. Because those checks weren't there I'd say it was an amateur mistake. Again, if this is the case then the engineer just made an assumption that this request can only be made in particular user state.
Here's one. A use-after-free triggered due to some faulty logic.
Mistake? Yes. Amateur mistake? No. Even very experienced C/C++ programmers, such as Microsoft's top devs, may accidentally double-free, or use already-free memory.
Re:Facebook CSRF leading to full account takeover (fixed)
by wglb on Sunday October 20, 2013 @12:30PM
(#6580390)
it is obvious they don't take basic security seriously
I would disagree.
For a very actively developed web site, it takes very good focus to not trip up. Having a bounty program is an indication to me that they take security seriously. Fixing a security bug in a matter of hours indicates to me that they take security seriously.
Re:Facebook CSRF leading to full account takeover (fixed)
by geden on Sunday October 20, 2013 @03:52AM
(#6579237)
Interestingly several of my wife's hotmail using Facebook friends accounts appeared to have been owned last night. Has someone found a new similar exploit?
Re:Facebook CSRF leading to full account takeover (fixed)
by chrismarlow9 on Sunday October 20, 2013 @02:56PM
(#6580998)
The exploit may not have been patched in the mobile version of facebook or may still work using a hotmail alias (passport.net or w/e). These are just guesses. I dug into Facebook security a while back and they seemed to have very little protection in place on the mobile site.
Re:Facebook CSRF leading to full account takeover (fixed)
by antr on Sunday October 20, 2013 @04:00AM
(#6579250)
I believe so. A friend with a hotmail account (although I don't know if he uses this hotmail account to login to FB) got his FB account hacked couple of days ago.
Re:Facebook CSRF leading to full account takeover (fixed)
by franjkovic on Sunday October 20, 2013 @02:04PM
(#6580774)
Redirect URL when you give access to Facebook is different for other email providers. Hotmail (that is, Outlook) is the only one that worked as far as I know - I have tested Gmail and yahoo, but neither of them were exploitable (there is also chance I missed something, so it is worth checking again).
Re:Facebook CSRF leading to full account takeover (fixed)
by ryansan on Sunday October 20, 2013 @02:58AM
(#6579150)
Did anyone else notice that the site and social networking properties were all put up at the same time as the post (roughly)? Good tactic for starting a business.
The "session" I found this bug in was around 2 hours long.
Also sounds like you should maybe try to move to a different country, if you can!
Because the system is complex, and security is hard.
It's certainly a mistake, but it was probably easy for developers and QA to miss.
Here's one. A use-after-free triggered due to some faulty logic.
Mistake? Yes. Amateur mistake? No. Even very experienced C/C++ programmers, such as Microsoft's top devs, may accidentally double-free, or use already-free memory.
They can't always catch everything, though.
I would disagree.
For a very actively developed web site, it takes very good focus to not trip up. Having a bounty program is an indication to me that they take security seriously. Fixing a security bug in a matter of hours indicates to me that they take security seriously.
Or would the effort not procure enough reward?