“Let The Hacking Begin” Declares Person Who Hacked Zuckerberg’s Facebook Page

http://techcrunch.com/2011/01/25/zuckerberg-fan-page-hack/

by remi • 16 years ago

72 34 16 years ago

mayank3• 16 years ago

Very interesting -- I wonder if this is the result of having so many API access points. The documentation page lists FBML+FQL, Graph, "Old Rest API", and "Old Javascript Client Library" as options: http://developers.facebook.com/docs/ Or are we back to good old XSS attacks?

tokenadult• 16 years ago

I wonder what HNers think is the way that this was done?

mayank3• 16 years ago

I wouldn't rule out some guy following Zuck around Palo Alto with airtools and hijacking cookies.

redthrowaway4• 16 years ago

It would be rather poetic if he just used firesheep, but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. Possible, but unlikely.

deutronium• 16 years ago

Does facebook use captchas, to slow bruteforcing, I tried entering a few wrong passwords for my account but didn't get one. However I doubt that bruteforcing or a dictionary attack was used.

socialmediaking• 16 years ago

facebook doesn't use captcha's as much as it does other security features. if there is a log-in from an ip address that seems suspicious, it can ask you to identify your friends in photos to verify your identity.

trotsky4• 16 years ago

captchas really aren't particularly suited to the task. The difference between even the most forgetful user and the lowest key bruteforce is so many orders of magnitude that it should be trivial to detect. I have no idea what facebook does, but most services just make it too slow to be practical: progressively slower responses, rate limiting, lockout periods. Another approach is to fail all authentications over a rate limit so that even if the correct password is guessed the attacker doesn't know. Long story short is defending a service against brute forcing is generally pretty easy.

bradly• 16 years ago

Firesheep.

The way iFrames are used by so many 3rd party sites to pull in likes, you don't even need to be on Facebook to be vulnerable.

lukeschlather2• 16 years ago

That's why I only use Chrome to browse Facebook, and use Firefox with NoScript for everything else.

And I regularly completely wipe personal data from Chrome (which interestingly doesn't give a mechanism to delete cookies on a per-site basis.)

trotsky4• 16 years ago

Nine times out of ten a targeted intrusion like this will have been the result of a spearphishing attack - malicious pdf, malicious link etc sent directly to a small chosen set of people.

I'm not personally familiar with how a high traffic fan page like this is managed, but I guess a fair number of people have access to it to delete spam, forward on interesting messages etc. It seems to me that a lot of those people might have the technical ability to post a new message - they may just be constrained by policy. So that's perhaps dozens of potential unsophisticated targets - interns, junior PR staffers. Like shooting fish in a barrel.

winfred• 16 years ago

Drunk intern that left three months ago and no password change policy on the account (*which I assume is used by the PR department, not Zuckerberg himself) .

tastybites• 16 years ago

I think everyone here is overthinking it.

He probably just left his account logged in at a friend's house.

trotsky4• 15 years ago

Target: the moderators/judges of the facebook coding contest

Approach: post links on the contest page to a site that claims to know future questions, write code for you, process your data whatever. They'll get deleted but some staff will inevitably want to check if it's legit.

Method: Today's money is on the IE CSS use after free bug - unpatched and widely available. Get some ie traffic by "this site requires Internet Explorer". Some other month it'd be a jre/flash/quicktime/pdf.

Execution: Transitory system access on one or more clients. Reverse shell or basic payload, good rootkits are expensive. Simplest is just copy cookies/autofills/saved passwords/ssh keys - for extra credit install a keylogger.

Low and behold, poorly_paid_intern not only despams the contest page but does the same for zuck's pr account.

IMO not a local wireless attack - who on the peninsula would have such a idealized view of facebook's financing? Also US citizen+high profile=bad idea, see doing a year for guessing Sarah's yahoo.

shaunxcode• 16 years ago

here's a direct link to where the short url was pointed: http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e4...

  http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e466a552708fc6e3863ef&thanksforthecup=https://www.facebook.com/photo.php%3Fpid%3D393752%26id%3D133954286636768%26fbid%3D170535036312026

trotsky4• 16 years ago

If facebook needs money, instead of going to the banks, why doesn’t Facebook let its users invest in Facebook in a social way?

Unnamed hacker reinvents IPO, tells world.

michaelchisari• 16 years ago

Well, damn, I'm not getting any sleep tonight. That's brilliant, I'll have to find a way to make it work.

bane• 15 years ago

I think that's already been invented in several forms:

Here's 2

a) Users donate money, a la wikipedia (except with FB they can advertise that they are great people and donated, thereby encouraging others to donate)

b) Users pay for access, subscription or some such. If it's optional, paying users get perks (more space for photos, searches across the graph, etc.)

axod• 15 years ago

There were also several startups that gave out shares to their users during the last boom.

I read it as suggesting the above - just give each facebook user a few shares in facebook.

law2• 16 years ago

I bet Mark Zuckerberg made that post, masquerading as a hacker. It wouldn't be the first time he's pretended to be one.

icandoitbetter• 16 years ago

Jealous?

law2• 15 years ago

Clearly.

motters• 16 years ago

The social business model http://www.youtube.com/watch?v=0C3XQ3BTd4o

jedsmith• 16 years ago

Anyone else notice that the headline authoritatively declares that it was a hack, then the article copy indicates that they're not sure?

Shocker, right?

izendejas• 15 years ago

Here's what a commenter, DogGunn, had to say (I copy below as I'm not sure it'll stay at the top):

"Article is wrong.

Mark's profile is here: http://www.facebook.com/zuck

And his like page is here: http://www.facebook.com/pages/...

Neither were hacked.

Someone had setup a fake profile at http://www.facebook.com/markzu... and fooled Techcrunch. Facebook fixed by deleting the fake profile."

A quick copy+paste pretty much confirmed it for me.

“Let The Hacking Begin” Declares Person Who Hacked Zuckerberg’s Facebook Page

Related Stories