How I Hacked Facebook and Found Someone's Backdoor Script

http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/

by phwd • 10 years ago

865 121 10 years ago

sveiss• 10 years ago

This isn't the first time files.fb.com has been publicly reported as having been breached: http://www.nirgoldshlager.com/2013/01/how-i-hacked-facebook-... .

coldcode• 10 years ago

Fascinating. Looking for a hackable system and finding someone beat you to it.

bediger4000• 10 years ago

The author and Facebook, Inc are lucky that the earlier hacker was just a regular spam criminal, not some bigtime "Nation-State Hacker". The Nation-State Hacker probably would have been a great deal more careful and not left easy-to-spot PHP backdoors lying around.

This also points out a weak area in our knowledge of hacking - how often does a given exploit get rediscovered? This and other anecdotes show that it happens at least once in a while. Prevalence of rediscovery could put lie to the NSA's "NOBUS" assumption, though. So we're likely to never see the results of such research.

morley• 10 years ago

This is a great write-up. I know little about pen testing, yet I was able to follow along easily.

TheGuyWhoCodes• 10 years ago

Nice work, very detailed. However this is hack of Accellion’s Secure File Transfer. How should Facebook, or anyone for that matter, protect themselves in these cases? I mean other then some obvious ones like not running as root, limiting file access, limiting network access to other servers...

chromakode• 10 years ago

Reason about the software as if it has already been compromised. Think about how user credentials and private keys the server touches can be used to attack other internal services, and try to limit the scope as much as possible.

tptacek8• 10 years ago

Which is apparently exactly what Facebook does with this thing.

6stringmerc• 10 years ago

Article is exactly as headline advertised, and a well-laid out write-up. Neat to come across it.

chatmasta• 10 years ago

It's buried in the bottom of the post, but I'm happy to see that Facebook paid a bug bounty of $10,000 for this. In the past we've seen Facebook refuse to pay bug bounties when the hacker goes beyond scope. Interesting that going beyond the usually scope of bug bounties actually discovered a latent exploit and helped Facebook. Maybe this will result in change of policies for bounty scope.

gillm4• 10 years ago

I know nothing about pen testing, but this was very interesting and easy to follow regardless. Thanks so much for sharing!

volkk• 10 years ago

I really think 10,000 for serious exploits like these is just not enough money. Even if OP only spent an hour or two on finding this out (although highly unlikely), they should pay based on seriousness/potential damage of the bug. Great writeup though. Super interesting stuff.

zodPod• 10 years ago

Seriously! Especially for a company as big as facebook!

dev1n• 10 years ago

common response to why companies don't pay a ton of money for these exploits [1]

[1] https://news.ycombinator.com/item?id=11249173

nickpsecurity6• 10 years ago

"Say they buy it for $20,000. Do you really think someone will derive $20,000 of profit from this before it's caught and patched by Facebook?

The only vulnerability worth $15,000 or more is one directly impacting a language, a widely used development library/framework or a widely used piece of software."

I think that statement might apply here given the FTA issues. Hackers could've gotten plenty mileage out of it. Especially if others at Facebook, like their AI team, used it for something that's a trade secret. That's speculation but it's not like hacking a news feed.

arcticfox4• 10 years ago

And I still think that line of thinking is bullshit.

The bottom line is that the dollar value for this stuff is arbitrary, and Facebook arbitrarily picking $10,000 for getting COMPLETELY OWNED and exposing any selection of personal data (in the case of the other bug, this one seems to have the potential to be even worse due to credential stealing, although it's murkier) is pretty gross IMO.

I don't know what the number should be - again, it's arbitrary - but in my personal book $10,000 is about 10x too low.

andrewprock• 10 years ago

The usual way to evaluate this is to consider the chance of being discovered (D) times the chance of being used as an exploit (E) times the cost of the exploit (C) with an appropriate discount factor (F). Think of the discount as the wholesale price of the exploit, what a mal actor might pay for the exploit.

For example, if there was a 1% chance of discovery, and a 50% chance of the person discovering it using it as an exploit, and it cost them 1 day of revenue ($50m) and they used a discount factor of 10%, that would indicate that the bounty would be worth about C * D * E * F = $25k.

If it's likely that the exploit would only last 5 hours, then $10k is a reasonable bounty.

awqrre• 10 years ago

I guess the only way to find out if that's true is to try and use the black market first?

nickpsecurity6• 10 years ago

I'd say $25,000 at least. It's a number I've seen a few companies cite for full-scope, penestration tests. Usually to sell their products they make the real money on. :)

Splines• 10 years ago

I'd have to say that it's pretty clear Facebook isn't offering enough, otherwise the first guy through the system would have claimed it.

nickpsecurity6• 10 years ago

Nice write up. Of course, this would be the team member whose photo is merely an Orange. Paranoid security people haha...

Part that jumped out at me, aside from obvious goodies, was this:

"FTA is a product which enables secure file transfer, online file sharing and syncing, as well as integration with Single Sign-on mechanisms including AD, LDAP and Kerberos"

...followed by...

"...web-based user interfaces were mainly composted of Perl & PHP... PHP source codes were encrypted by IonCube... lots of Perl Daemons in the background"

Wow. That inspires a lot of confidence in the "secure" product. I'd have doubted Facebook relied on such a system had I not known they built their empire on PHP. We all know its reputation. Their "secure, file-transfer appliance" fits right in.

utefan001• 10 years ago

Seems like two factor authentication here would have helped.

jcoffland• 10 years ago

How?

willvarfar• 10 years ago

They were able to snarf passwords plaintext.

Torgo• 10 years ago

Because the backdoor was logging fb developer credentials. The stolen creds would not be useful with two-factor required every time.

mxuribe• 10 years ago

Quite clever find! Good write-up, too! Kudos!

reginaldo• 10 years ago

This is Reginaldo from the Facebook Security team. We're really glad Orange reported this to us. On this case, the software we were using is third party. As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook. We do this precisely to have better security, as chromakode mentioned. After incident response, we determined that the activity Orange detected was in fact from another researcher who participates in our bounty program. Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access.

omash• 10 years ago

Is what the other researcher did (collecting usernames and passwords) in scope? Is it impossible to use these credentials to get above standard privs on any part of facebook?

d334• 10 years ago

This is pretty much why we shouldn't be trusting centralized services at the scale of Facebook. Given that two researchers got that far, sooner or later another will actually manage to escalate the privileges. And then, I'm not sure what we should be more afraid of - leaking it all to public or some three-letter agency using it for nefarious purposes...

Seriously, don't do Facebook. Not even once.

nemothekid2• 10 years ago

This reasoning is really flimsy. Are you suggesting a that a normal user will do better at securing their home grown system than a team of trained security engineers?

onewaystreet3• 10 years ago

With that logic you might as well stop using the internet altogether.

rnhmjoj• 10 years ago

It's more like we shouldn't trust a third party closed source software for a task that is supposed to be done in a secure way.

outworlder• 10 years ago

two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access.

Are they allowed to escalate access, given the bounty rules?

Also, isn't the periodic collection of login credentials completely out of scope? What I mean is: once the initial vulnerability was located and the pentester got shell access in the system, shouldn't he have stopped there and reported?

apeace• 10 years ago

Are they allowed to escalate access, given the bounty rules?

No. From Facebook's responsible disclosure policy [1]:

You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.)

Both of the pen testers in this situation broke the rules. Once they found a security issue they exploited it and probed for additional issues (as well as one tester who attempted compromise of sensitive company data by collecting logins).

It's good that Facebook doesn't always apply these guidelines to the letter.

[1] https://www.facebook.com/whitehat

Dr_tldr2• 10 years ago

You can read the story from a few months back to find that Facebook apparently has an unstated but non-repudiated policy of threatening to involve the FBI and actually doing reputational damage to researchers who they feel cross a (poorly described and enforced) line: https://news.ycombinator.com/item?id=10754194

In this case, they (correctly) went the other way, which creates even more uncertainty. Given this pattern of inconsistent enforcement mixed with threats, I would feel genuinely unsafe reporting a security vulnerability to Facebook except under very specific conditions. That's probably not what they're going for, but that's the environment they're creating.

peterwwillis2• 10 years ago

"As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook."

"Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access."

From the write-up:

After checking the browser, the SSL certificate of files.fb.com was * .fb.com …

You left a wildcard cert on this random internet-facing unaudited 3rd party linux box with no protection against data exfiltration, or an HTTPS proxy in front of it, or anything? I know it's not as critical as facebook.com, but this is still bad. Priv escalation CVEs for Linux come out like every month.

At the very least, using this cert, anyone could run a MITM on any * .fb.com service and compromise without ever breaking in. From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron. I'm hoping you did actually have a proxy in front of it and Orange just didn't catch that.

onewaystreet3• 10 years ago

no protection against data exfiltration

That's a big assumption

brians• 10 years ago

Figure that was probably a CDN, and you don't know the origin configuration

spicyj• 10 years ago

From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron.

The article claims those are tfbnw.net, not fb.com.

dkopi• 10 years ago

"I'm hoping you did actually have a proxy in front of it and Orange just didn't catch that."

That sounds a lot more reasonable than actually having the private key on each individual server.

kosmic_k• 10 years ago

Facebook's stance on vulnerability research is incredibly admirable. I can only home more companies hold themselves to the same high standard.

jedicoffee• 10 years ago

This is quite confusing. "A brief summary, the hacker created a proxy on the credential page to log the credentials of Facebook employees. These logged passwords were stored under web directory for the hacker to use WGET every once in a while".

So they were grabbing creds, but it's ok it was just a researcher? Pretty sure that's crossing the line and indicative of an actual compromise of employee credentials.

Davidghosh• 10 years ago

I believe, all rich firms,including FB,Microsoft,google and many others, who are fooling public and minting trillion $,will be hacked and more advance sophisticated tools will be invented by a specific hacking group to hack them.Look Panama Paper.It is also a science & advance technology.

David Ghosh

7060731742• 10 years ago

i am problum id

ledy• 10 years ago

https://www.facebook.com/sumyangriani.cieimouetz?fref=ts

dopamean• 10 years ago

I'm not sure I understand some of the comments here claiming that 10k is not enough money for this. It clearly is enough money because Orange found the problem and reported it.

These arguments always remind me of people claiming that certain professions are not paid enough. They forget that there is a market for labor and in this case the labor is finding vulnerabilities. People will either be willing to work for the posted price or not. In the case of pen testing facebook I'd be willing to bet there are plenty of people out there looking for bugs who aren't even really concerned with what the final payout is going to be.

Yeah, they could have gotten completely owned if he didn't report this. But to him reporting it and getting 10k in compensation was sufficient. Why would facebook pay him a million if he was willing to take 10k?

awakeasleep• 10 years ago

There is an implicit "without exploitative downward pressure on wages" clause to the sentence every time people say "_______ isn't paid enough"

You forget that no assertion of values makes sense when divorced of context.

interurban• 10 years ago

Because the pay scale is subjective and the reporter doesn't know the amount before they report. FB and others have guidelines for their bounty programs that leave an upward bound open for severe vulnerabilities.

The argument these comments are making is that this report should qualify in some way for a higher payout.

I'm not arguing for either side here, just noting that the comments that you refer to are fairly reasonable.

nickysielicki• 10 years ago

There are two markets for this type of labor: one provided by the bounty programs and one provided by those who want to abuse the vulnerabilities, eg: secretive three-letter-agencies, etc.

I would imagine that the latter of the two is almost always willing to pay more. I would also imagine that by the time you're a skilled pentester, you're in your mid-to-late thirties and maybe are worried about how you're going to put your kids through college, or how you're going to retire.

So what do you do? Do you take the larger sum of cash and plague yourself with worrying about bitcoins, how you're going to lie on your taxes, and deal with the ethics of helping shady organizations?

Or do you help the company? Now you don't have to lie on your taxes or launder bitcoin, but you do have the pressure to find more security problems to make enough cash to meet your financial needs.

And the ball is solely in the court of the companies running bounty programs-- if they were to always provide more money than the black market, there's virtually no reason to bring it to someone else.

I don't think it's unreasonable for them to not want to give away more than they have to, but I get the sense that there's little to no negotiating power for the vulnerability finder-- and they should probably work on that.

tptacek8• 10 years ago

No, there isn't. Message board nerds love to try to reason through vulnerability valuation, but the reality is that there are very few people who will pay for serverside vulnerabilities at Google or Facebook (or anywhere else).

The reason is that for a vulnerability to be worth money, someone needs to have a business process ready to go to monetize the vulnerability. Without that proven process, a vulnerability is just like any "Show HN" without a business model or revenue.

There are certain kinds of vulnerabilities --- browser code execution, most notable, but a couple others --- that organized criminals have whole businesses set to drop in and run and make money with. If you have one of those vulnerabilities, you've got lots of takers for it, and the prices for those vulns are nosebleed high.

There are a few kinds of organizations that will pay for a Facebook serverside RCE. Good luck finding them. Or, I should say, not finding them. Those same organizations will kill you and your whole family just to make a point. That is, after all, the only reason they want to buy Facebook serverside RCEs.

arcticfox4• 10 years ago

It was enough for Orange. But think about demand elasticity. Perhaps there are 100 other Oranges for whom the bounty was not enough.

Clearly the bounty was not enough for the mystery attacker / researcher / hacker / whatever that Orange discovered exploiting the same hole.

baby5• 10 years ago

From Reginaldo's post it appears that it was another bug bounty guy who was the mystery attacker.

Certhas• 10 years ago

There is no free market of labour. Under penalty of death you are forced to sell your labour. Ultimate buyers market.

MawNicker• 10 years ago

This is a beautiful summary. Thank you. I will be stealing this.

oconnor663• 10 years ago

Companies die without employees too!

A little more seriously, somehow we have to find language for different types of coercion. Otherwise we'll end up lumping the whole complicated world into one lump.

JBReefer• 10 years ago

I could choose to sell a different form of my labor, like my ability to perform physical labor instead.

kolinko• 10 years ago

You can run your own business.

lawnchair_larry• 10 years ago

So since they were unable to pivot laterally, you pat them on the back and call it a win. But last time someone did successfully pivot laterally, you threatened his employer? You guys are really sending mixed messages! Are they allowed to escalate or not? And if that's the new policy, shouldn't you pay the other guy who did escalate?

mkane848• 10 years ago

That's kinda disingenuous and you know it. From the previous discussion[0], you should know not to take one side of the story at face value.

[0]https://news.ycombinator.com/item?id=10754194

brazzledazzle• 10 years ago

Having participated in that conversation I can say that the timelines and statements from facebook were suspect. I'm sure the researcher didn't make the best choices but how facebook handled it was horrible and should make anyone participating in that bug bounty carefully consider every action they take against facebook's infrastructure.

nickpsecurity6• 10 years ago

Wow. That was an interesting set of comments to read. The consensus of the crowd was actually against Facebook in that probably due to their overpromising on bounties for big compromises and under delivering plus going after dude's job. A number of security professionals, including a friend of Stamos, were against that because he dumped and sat on data plus had his business info involved. Cited expectations of pentesters and responsible disclosure. What a mess.

I don't think Wes acted in good faith in that one but neither did Facebook in anything privacy-related. Who cares about fundamental ethics given parties involved. I will say his actions were nearly warranted if Facebook was promising huge bounties for something that could cause them big problems which that case seemed to be from that thread's comments. I don't know for sure.

Far as escalation or downloading data, I found that to be the only way to get taken seriously by management. Had to be done non-disruptively with trusted personnel, protection of that data (eg RAMdrives, crypto), and assurance it was gone after. Rarely even read it as filenames & credentials were enough. Nothing like showing marketing plans or private emails to execs with a contract that's vague enough for it to be legal to get security taken seriously. Responsible disclosure debates of 90's showed us that letting vendor decide almost always resulted in them downplaying risk saying it "hypothetically" could do something but probably overstated. People playing that game usually get bounties that yearly add up to less than a median IT person.

Rather not play that game. If the company bullshits, do what you can within their legal framework to call them on it and provably without doing any damage. If they didn't in that case, then he went way overboard and looks like he's running an extortion racket. I think key parts of the story aren't published and I can't be sure. Good news is Facebook and Wes both of don't mean shit to me. Moving on. Appreciate the entertainment and different perspectives, though. :)

tptacek8• 10 years ago

That's not what that person did, and you know that, because you were on the thread where this was picked apart.

The person who had problems with Facebook didn't "pivot laterally".

He popped a shell, dumped and banked directories from the server, held them secretly, and used their contents more than a month after reporting the bug to Facebook as a cudgel in a dispute over a bounty.

frostymarvelous6• 10 years ago

I just went to that thread, read both articles and the HN thread. Your post is completely inaccurate.

dang• 10 years ago

We detached this subthread from https://news.ycombinator.com/item?id=11543926 and marked it off-topic.

ryanlol• 10 years ago

Only $10000? What the hell do you have to find to qualify for that "million dollar bug"?

fabulist• 10 years ago

If you can find a way to use their backup tool to download an arbitrary user's profile, and they don't pay you out at $1M, "BS" can be safely called.

oliverhands• 10 years ago

i hacked facebook and someone saw me hacking and siad why are you hacking and so that's how i hacked facebook

libber• 10 years ago

If there is someone to be upset with in this situation its accellion the vendor who backs files.fb.com.

Looking at how egregious their security mistakes are they dont appear to take security seriously.

This is the same company that (last I was down there) had a billboard on 101 that says "Secure".

Many echos of oracles "unbreakable" ad campaign while being an aggressively bad at security company

Techbrunch• 10 years ago

This is the same researcher that found a RCE in Uber: https://hackerone.com/reports/125980

Shameless plug but if you like that kind of articles I suggest signing to my newsletter: http://bugbountyweekly.com. A free, once–weekly e-mail round-up of news and articles about Bug Bounty.

edem• 10 years ago

Why do you use so much emoticons in your article?

frostymarvelous6• 10 years ago

So Wes got only 2.5K after successfully proved he could access signing and api keys,after he was threatened with a lawsuit.

How does setting up a shell and collecting credentials and then downloading them later give you a pat on the back?

Is this some kind of a joke?

ayben• 10 years ago

emreayben23

How I Hacked Facebook and Found Someone's Backdoor Script

Related Stories