Using Facebook Notes to DDoS any website

Re:Using Facebook Notes to DDoS any website by eyeareque on Friday April 25, 2014 @06:08PM (#7649337)

I'm surprised they aren't going to give him a bounty for this. I also assume they realize that most reporters will post their rejected findings soon after they get denied.

If enough people start using technique they will have no choice but to create a fix for this.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by Artemis2 on Friday April 25, 2014 @06:22PM (#7649406)

They were probably aware of the issue, as this kind of bug has been already published for Google [1] (by the same author, it seems) a month ago. Also, Google did not give him a bounty reward for his discovery.

[1] https://news.ycombinator.com/item?id=7371176

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by chr13 on Friday April 25, 2014 @06:31PM (#7649462)

I actually found this bug first in Facebook and later in Google. Facebook said they needed time to think about this and I was hoping they would fix it, so I could not disclose this back then.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by patcheudor on Friday April 25, 2014 @09:17PM (#7650019)

Join the club. I've reported it before as well, years ago. I even discussed it on my FB wall at one point with some tests against my own site. I never re-tested, figuring they'd take care of the issue. Guess not.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by wisty on Friday April 25, 2014 @07:22PM (#7649714)

It doesn't really hurt Facebook.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by mey on Friday April 25, 2014 @08:21PM (#7649896)

Tying up these servers impacts them, makes people start blocking them, breaking this service.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by brohee on Friday April 25, 2014 @10:31PM (#7650166)

Well if enough people point the images to a tarpit it might...

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by vezzy-fnord on Friday April 25, 2014 @06:21PM (#7649402)

https://www.facebook.com/whitehat

      Exclusions
      The following bugs are not eligible for a bounty (and we do not recommend testing for these):
      ...
      Denial of Service Vulnerabilities
      ...

That said, they do appear to be quite hypocritical when it comes to enforcing this, as at least one user on the /r/netsec thread claimed that Facebook paid them for a mail bombing vulnerability.

I guess you have to use this to attack high-profile targets (or Facebook themselves) until they notice.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by chr13 on Friday April 25, 2014 @06:37PM (#7649491)

It's not clearly stated. I think what they mean to say is DoS on Facebook using brute force mechanism as testing this would bring down the Facebook system itself. Now manipulating Facebook's server to cause the attack, that'd be different I guess.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by mattmanser on Friday April 25, 2014 @07:43PM (#7649788)

I agree with you, forcing Facebook to be your zombie of doom is very different to attempting to DoS facebook.

If you can easily cause any website to become an on demand low orbit ion cannon, they're going to cause problems.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by userbinator on Friday April 25, 2014 @07:54PM (#7649831)

> If you can easily cause any website to become an on demand low orbit ion cannon

You can do this with any website that lets users post links which may or may not be automatically loaded (by other users too). There are tons of these around; forums, blogs, etc. See also: Slashdot effect. That's also a true DDoS, coming from many IPs, as compared with a few of Facebook's servers.

[ Parent | on HN ]