Facebook security hole allows viewing of private photos

http://forum.bodybuilding.com/showthread.php?t=140261733

by zone411 • 15 years ago

372 137 15 years ago

forum.bodybuilding.com

DrinkWater• 15 years ago

Seems to be already fixed. The last option described in this tutorial is not there anylonger.

willvarfar• 15 years ago

Reading the thread, it seems that it doesn't work for all accounts and there is speculation it only works if you have us english locale.

funkeemonk2• 15 years ago

Created a throwaway account to test this against my own account, didn't work even with US English set. There's more to it.

joelhaasnoot• 15 years ago

May be a new option that's only being deployed to a small set of users.

vineetdhanawat2• 15 years ago

It still working for me. Tested few minutes back. I tried this on different proxies as well, so it cannot be region specific.

Maybe they are rolling it out (lets say blocking it out) slowly now.

robertjordan• 15 years ago

Excellent find. You can even access around 25 photos from Mark Zuckerberg's profile.

http://imgur.com/a/PrLrB (ps: what a nice photo of them on halloween. very generous too I can see!)

llambda2• 15 years ago

Interesting that those are full-sized. It appeared in the forum post to only be giving access to thumbnail resizes of the original images.

slig• 15 years ago

Apparently, you can change a char in the thumb URL to get the full size image URL.

CWuestefeld• 15 years ago

If that doesn't prove that FB's developers aren't thinking about security, I don't know what would. Nobody who is in a culture of protecting security would even consider building this.

tectonic• 15 years ago

Or privacy. The assumption here is that if someone thinks you have an inappropriate photo, you now have no right to privacy?

judofyr• 15 years ago

I doubt that's way this happened. More likely, the person who implemented the "inappropriate photo"-feature wasn't fully aware of that the "Report"-functionally was enabled for everyone and not just your friends.

However, someone had to implement the backend for listing out those photos, and they clearly didn't think of access control, so there's at least something fishy here…

ajross• 15 years ago

No, it's surely just a mistake. No one made an affirmative decision to skip "privacy". What happened is that whoever added the "select more images to block" feature somehow did it in a way that skips the normal access checks.

If there's a goof here, it's that the framework they've built apparently doesn't make the privacy controls mandatory. Developers have to remember to "turn them on" by calling an access control predicate or whatnot. That's bad. That's dumb. But it's not malicious.

speg• 15 years ago

That's why their philosophy is 'Move fast and break stuff'. The alternative might be a slow moving bureaucracy that never iterates new features.

pak• 15 years ago

"Move fast and break stuff" is a philosophy that is simply not compatible with "Your privacy is very important to us" (http://www.facebook.com/legal/terms) and "We take safety issues very seriously, especially with children" (http://www.facebook.com/about/privacy/minors).

citricsquid• 15 years ago

It would seem based on the screenshot ("Message x to ask them to remove the photo...") that they must have specific permissions set to cause this to work as I can't replicate on people that I can't message.

jerfelix• 15 years ago

I disagree. You can message people that you aren't friends with. See the first screen shot ("add her as a friend or send her a message").

I think the reason it only works on some profiles it that perhaps the profile pictures are the only ones that it will show you. And some people only have one profile photo. (This is an untested theory / guess.)

synnik• 15 years ago

Whether or not non-friends can message you is a privacy setting.

funkeemonk2• 15 years ago

Tested this theory against my account using another throwaway one. My real account has several profile pictures and the exploit didn't work.

einhverfr• 15 years ago

Facebook is an excellent personal marketing tool. However, I think at this point you'd have to be a fool to put material on it you want to be private. Of course, what PT Barnum said....

baha_man• 15 years ago

"Of course, what PT Barnum said..."

Or possibly didn't say:

http://en.wikipedia.org/wiki/Theres_a_sucker_born_every_minu...

rodion_89• 15 years ago

It looks like HN removed the apostrophe so here is a bit.ly version that works.

http://bit.ly/kyYCxk

Archio3• 15 years ago

This isn't even a security hole, it's a complete security disaster. Did they even think through the process for five minutes before they built that? I mean, there aren't even any hacks involved.

Nice find.

tantalor2• 15 years ago

> there aren't even any hacks involved

I doubt law enforcement would see it that way. Downloading photos with this method is not much different than guessing somebody's email or voicemail password; you're accessing something you're not supposed to.

See 18 U.S.C. § 1030(a)(2)(C) and § 2701.

Archio3• 15 years ago

Well, the question is, how far does that go? If I put up photos on a public web server intending them to be private, is that still legal?

pepper92• 15 years ago

This is probably closer to guessing someone's phone number than their password.

ianhawes• 15 years ago

This is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?

Archio3• 15 years ago

I think it's a stretch to call this "just" a mistake. First of all, there isn't any malicious code that has to be run to execute it, it's a simple as clicking a few buttons in the UI.

Secondly, Facebook is a site with hundreds of millions of users managing billions of private photos. With the amount of revenue & number of developers they have, it's inexcusable that they can't think through a simple process like this without considering what happens if two users aren't friends.

Granted, they're probably not "trying" to undermine privacy. But they're doing a very poor job at maintaining it.

nyellin2• 15 years ago

I'm downvoting you for saying I think it's a stretch to call this a mistake

If it wasn't on purpose, it was a mistake. Period.

It might be inexcusable, as you later pointed out, but it was still unintentional. Everyone likes to hate on Facebook. If this was a YC startup, I suspect people would be more forgiving.

TheCapn• 15 years ago

A security hole is where some attack vector within the code is overlooked (ex: injection attacks, overflows). A negligent feature is one where the steps to exploit the service were put in explicitly.

What one does this fall into?

At some point a developer coded in a resource that bypasses any privacy data, had it approved by management/coworkers (not sure what model they use) and published it live. I'm certain many people have been exploiting this longer than that forum post existed.

Groxx3• 15 years ago

Honestly? I'm willing to chock this up to a mistake. A reasonable series of circumstances for this would also be that they missed a single permissions check on an otherwise private-only method. It's probably a single line of code, and one that exists in thousands of other places, surrounded by at least hundreds of other lines of code. An easy thing to overlook.

rmc• 15 years ago

I think people know that this is a mistake. But it shouldn't have happened. Facebook is a massive, wealthy company that has many many programmers. Bugs like this should not have happened, considering that privacy is one of the biggest media problems Facebook has.

brlewis2• 15 years ago

If you see a comment that makes it sound like there's a vast conspiracy, please post in reply to that comment. I don't see any such comment. HN appears to be comprehending just fine.

cbabraham• 15 years ago

http://news.ycombinator.com/item?id=3319018

This comment seems to argue that this was intentional.

raphman• 15 years ago

No. This shows that Facebook has no robust security model at all. Either they do not have any mandatory access control for private data, or someone approved of circumventing such access control measures for this feature. Both is in my opinion inacceptable for a company holding so much potentially sensitive data.

Groxx3• 15 years ago

One example of a hole does not make a bucket into a sieve.

For a company of FBs size and personal data contents, I agree, they have a rather scary track record. But saying <symptom of X> implies <X> is fallacious, especially when it's also a symptom of <AAA> through <ZZZ>.

damoncali• 15 years ago

There is a lot of muscle memory to overcome here. It's like Jeffrey Dahmer accidentally killing someone. You can't blame people for jumping to conclusions.

marquis• 15 years ago

Is Facebook not hiring some of the most talented developers in the industry? This is a ridiculous mistake that should have been tested for prior to production.

spitfire• 15 years ago

No. I went to school with someone who now works at Facebook. To describe him as "most talented" at anything would be a mistake. However, he did have no regard for others or their work.

kristopolous2• 15 years ago

General form appears to be as follows:

    http://www.facebook.com/ajax/report/social.php?
     __a=1&
     __d=1&
     attach_additional_photos=1&
     cid=((FBID))&
     content_type=0&
     h=((HASH BASED ON YOUR ACCOUNT))&
     phase=6&
     report_id=1&
     rid=((FBID))

After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy.

This issue is probably going to make mainstream news by noon.

hoolash• 15 years ago

How would this be sent? entering into the address bar returns a blank page, and no change on profile pages.

kristopolous2• 15 years ago

Sorry just got up ... anyway ... I got it through Firebug and was able to reproduce it in a FireFox Tab, so I assume it was a GET, although it may have been a POST; I didn't cURL the URL from outside the browser though; I'm sure you need cookies.

noname123• 15 years ago

I tried to follow this url format by using Chrome Developer toolbar after clicking on "report this photo" of a non-private photo to extract my account hash id, rid and cid of the interested person. It's a GET according to Developer tool.

I get this however,

for (;;);{"__ar":1,"error":1357006,"errorSummary":"Don't have Permission","errorDescription":"You don't have sufficient permissions to do that.","payload":null}

Anyone know if it's already patched?

axiomotion• 15 years ago

Get the same error, guess it is already fixed.

djbender• 15 years ago

still works.

hannibalhorn• 15 years ago

Funny how something like this is originally posted on a body building forum. I think the first reports of the recent Penn State scandal were posted there too (around a year ago.) Who would have thought that's where you'd first find such things?

pud• 15 years ago

Bodybuilding.com started as a forum about bodybuilding, but over the years morphed into a large general message board with all sorts of members.

Behold, "misc," the /b/ of bodybuilding.com: http://forum.bodybuilding.com/forumdisplay.php?f=19

driverdan• 15 years ago

This was posted in Misc. Misc has nothing to do with bodybuilding, it just happens to be part of a bodybuilding forum.

As pud mentioned, they're basically /b/tards.

tuppy• 15 years ago

The Misc is probably my favorite general forum on the internet. Suprisingly-high level of discourse and genial atmosphere for a forum dedicated to lifting weights. HN would be pretty impressed with the number of engineers and entrepreneurs there as well :)

Zhenya• 15 years ago

Boy, I wonder what the FTC will say about this...

digitalsushi• 15 years ago

Don't do it, kids. You'll find photos of that girl you pined for 2 years after you never made your move and she's way more fun and in way better shape than you ever guessed. It's rough to ruin the fantasy, but torture to augment it.

kmfrk• 15 years ago

This is how many days after the FTC settlement?

tzury• 15 years ago

someone [1] pulled this trick on Zuck's account [2]

1. http://twitter.com/#!/flyosity/status/144065873743839233

2. http://imgur.com/a/PrLrB

brlewis2• 15 years ago

One of the images is of the last paragraph of the FTC page about Facebook where readers are invited to Like the FTC on Facebook. Background: http://news.ycombinator.com/item?id=3291909

jdp23• 15 years ago

I wonder if the FTC will follow through on the settlement and fine Facebook $10,000 for each violation? There's a dozen or so photos of Zuck, so that's $120K already ...

bilalhusain• 15 years ago

hold your horses; the tweet is 48 minutes ago where as robertjordan has a comment on this very page with a timestamp of 4 hrs ago at this moment.

edit: imgur album was also created 4 hrs ago

balsam• 15 years ago

i'd like to see these tagged. (seriously) anybody knows what they are drinking in that last pic? The bottle looks interesting.

tptacek5• 15 years ago

Looks like Johnnie Walker Blue.

I'm a little skeezed out at having looked at these photos at all, but "name that liquor" will apparently (in borderline cases like this) trump my principles.

coverband• 15 years ago

Is he going to kill that poor dog to eat for dinner?

alexgartrell• 15 years ago

I doubt it https://www.facebook.com/beast.the.dog

flyosity• 15 years ago

This is a little too meta... I tweeted that (that's me!) but the link to Zuck's photos was found further down in the comments here on HN. That's where I saw it.

karlzt• 15 years ago

https://news.ycombinator.com/item?id=3318903

pasbesoin5• 15 years ago

Seriously, FB, do you have no QA whatsoever?

I wonder whether this is limited to photos in the profile album, or whatever it is called, these days.

EDIT: I'll add this suggestion that I've made before, since you're going to have a LOT of people wanting to delete photos, if this problem proves to be significant. Delegate someone to spend a few hours writing a routine that will replace a cached photo with an identically sized, all white (or black, blue, whatever), no metadata generated image. So, you don't have to rebuild your image caches in order to ensure that a photo is really gone (well, except for the fact that it once existed, as demonstrated by the working URL and white image).

I've read the excuse made in the past that aggressive, large, integrated image caches made actual photo deletion "not an option". As long as you can overwrite existing bits in place, this should solve that. (Although I don't know about all the tagging you've now since overlaid onto the images.)

vaksel• 15 years ago

isn't there another problem with facebook, where none of your photos are ever deleted and can be accessed by the direct url at any time?

pasbesoin5• 15 years ago

I haven't kept up, but IIRC that used to be the case. And that's what I'm addressing.

A few years ago, I believe, they explained that they generate these ginormous image caches where, IIRC, individual images are not distinct files.

My point is, regardless, if you can find the image (and its extent), and if the cache data are still write-able, then overlay a generated "blank" image onto the cached image, in place. You still have some data leakage, in that the working URL confirms that there was an image having that URL. But for most cases, I believe this would suffice.

I guess they'd also have to track down and overwrite the various thumbnail versions, but if their systems can already find these in the course of their normal work, this shouldn't be a problem.

As for overlaid tag data and whatnot, I'm not sure what to suggest. At a first pass, I'd suggest just deleting (or "offlining" or whatever, given that FB apparently never really deletes anything) that data. But I don't know what continuing dependencies that might break.)

EDIT: I should add that I don't know whether/how such image caches are replicated. And perpetuating such an overwrite against multiple replications might not be easy / something the existing design supports.

Nonetheless, I think it's something they should support. At a minimum, when a user really wants to delete an image, then overwrite its segment of whatever image cache file with a "blank" equivalent.

Although... then you get into what may be legally required and/or prudent, from FB's perspective, to retain.

I'll stick to the simplistic user perspective: When I say delete, I mean delete.

simondlr• 15 years ago

Moving fast and breaking things.

mrgreenfur• 15 years ago

Ugh, JW blue

lobster45• 15 years ago

This is why I never post private pictures on Facebook

ricksta• 15 years ago

I wonder how people discover this

mkjones9• 15 years ago

This was indeed a bug, and shouldn't work any more. We turned off the system that lets you report content through this flow (and thus made this bug's code inaccessible) as soon as we became aware of the issue.

In the future, if you find a security / privacy bug on Facebook, feel free to report it via our whitehat program, which will get things looked at more quickly than random blog posts. You can get credit for the find and even make money with bug-bounty payouts: http://www.facebook.com/whitehat/.

For what it's worth, a few people were alluding to this meaning that we don't check privacy by default. In fact we do have a pretty robust default-deny system for running privacy checks. This was an edge case where it was forced to work in a way that was incorrect.

(I work at Facebook, but not on this system.)

corin_7• 15 years ago

It's still possible to make the request using:

  http://www.facebook.com/ajax/report/social.php?__a=1&__d=1&attach_additional_photos=1&cid=XX&content_type=0&h=YY&phase=6&report_id=1&rid=XX

Where XX and YY can be found by watching the net request made when clicking the initial Report/Block button.

That said, I'm not sure if it is returning private photos, or just photos that are public - possibly you guys have fixed it on this side, not just the front end having links to it, but figured I'd mention it in case not.

mkjones9• 15 years ago

Thanks, we'll take a look. In the future you should use https://www.facebook.com/whitehat/ though, as I unfortunately don't catch every HN comment :-).

soult• 15 years ago

It is great that you have a page specifically for reporting security issues. For some companies I had to resort to reporting security issues to the main contact address where it landed at some first-level support guy's desk who had no idea what to do and in the end I gave up and the security hole stayed open.

One thing though: Your bounty of $500 is quite low. I bet this whole incident did/does a lot more damage than that. And to be honest, if I had the choice between $500 and trolling Mark Zuckerberg by posting his private photos album online, I would probably chose the latter option (sans the posting a howto on a forum part).

Disclaimer: I am not a security researcher, I don't even look for vulnerabilities. I just sometimes stumble upon bugs and get curious what other side-effects this bug might cause.

mkjones9• 15 years ago

Glad you like it! $500 is actually just the base bounty - I've seen payouts for quite a bit more depending on how nasty the bug is.

At least for me personally, it's not the posting of one person's private photos that is most frustrating - it's public posting of repro instructions so that script kiddies can exploit a bug. That just seems irresponsible.

aw3c23• 15 years ago

If people submit via that whitehat feature, do you publisize "XY was possible until 20XX-XX-XX"? I consider that important information.

mkjones9• 15 years ago

I don't think we post any details about the exploit, just the fact that someone reported it (see https://www.facebook.com/whitehat). Of course, once we've fixed the bug, the reporter is free to write about the exploit, how long it was live, etc.

zone411• 15 years ago

Knowing about your special page for reporting privacy holes would not change my decision to post it here. I think more good will come when media picks it up and some Facebook users realize that a company with your record of terrible privacy decisions and incompetence should not be used for posting anything private or even at all. If you were a startup stretched for resources or if this hole could've been exploited to install malware, I'd of course attempt to contact you first. $500 for reporting security holes for a company of your size is also insulting, BTW.

mkjones9• 15 years ago

The idea with responsible disclosure is that you want to maximize safety of the public by incentivizing vendors to fix problems while not letting malicious actors exploit them: http://en.wikipedia.org/wiki/Responsible_disclosure. Once the vendor has fixed the flaw (or refused to, or taken longer than a reasonable time to do so), it's generally accepted as OK to publish details. You can of course get whatever media coverage you want at that point.

I'm curious - do you think responsible disclosure is a bad idea? Or is the "badness" of this bug small enough (compared to malware) that you think it's better for the common good to publicly post the repro instructions and enable many users to exploit it?

I think having a bug bounty program is actually a lot better than the vast majority of sites / vendors that don't even have a whitehat disclosure program, let alone a bug bounty program. It's worth noting that this is just the base bounty - I've seen us pay out a lot more for good discoveries. $500 is also the base that Google and Mozilla offer for their programs (http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w..., http://www.mozilla.org/security/bug-bounty.html). What would be a good price, do you think? I'm not hooked in enough to know what black market prices are like for bugs like this.

mkjones9• 15 years ago

Ah, just realized you're the OP. I don't think there's anything particularly irresponsible about posting an already-public disclosure to HN or other aggregators. It's the first person posting it publicly without first privately disclosing that I find irresponsible.

TallGuyShort2• 15 years ago

This was a couple of years back, so maybe the attitude has changed, but... The last time I reported a security problem to Facebook, I got an email warning me about my online activity, telling me that my account might have been hacked, and that my password had been changed as a result. Several weeks later the problem I had been trying to report was still there. I've heard similar experiences from several other people - so even though this guy looks like he was being irresponsible, I personally will no longer report security problems to Facebook because I don't feel like it would get taken seriously, and will probably only inconvenience me further. I'm not sharing this to flame Facebook, I just would honestly like someone on the inside to know this is a problem. I never knew about the whitehat link because all I see on the Help page is targeted towards victims that probably don't know what they're doing.

mkjones9• 15 years ago

Shoot, sorry to hear that. I think our attitude has always been pretty good, but the communications channels a few years ago were just not great or easy to find (it sounds like you were stuck on a "my account was hacked" workflow).

We've improved a lot in the last couple years though - we launched the explicit whitehat program in 2010: http://www.insidefacebook.com/2010/12/22/facebook-security-t... and the bug bounty in July of this year: https://www.facebook.com/security/posts/238039389561434.

Feel free to respond here or let me know if you ever run into similar issues with the whitehat program (hopefully you'll change your mind about no longer reporting security problems!).

dpeck• 15 years ago

The more often this happens, maybe the more normal people will understand that anything put online should be considered to be public. The illusion of the walled garden eventually comes down, either through a vulnerability, policy change, or simply user error.

blob4000• 15 years ago

mirror to exploit instructions + pictures http://www.multiupload.com/RC184ELRZ9

Facebook security hole allows viewing of private photos

Related Stories