How does Facebook disable Developer Tools?

http://stackoverflow.com/questions/21692646/how-does-facebook-disable-developer-tools

by gedrap • 12 years ago

258 86 12 years ago

plorkyeran• 12 years ago

I'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?

ihsw• 12 years ago

Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.

reconbot• 12 years ago

Because the "hackability" of the web is important. The ability to view source, play in the console, modify the dom, etc is amazing. Locking it down or providing a larger barrier to entry (eg, download this extra thing) provides dubious benefit and hides what makes the web great.

I speak from someone who teaches ruby and javascript. Javascript is in every browser and the console is a wonderful place to start. When I teach ruby (on Mac's) I have to start with, "well ok, now download xcode". It's really easy for someone to give up before getting everything working.

ploxiln• 12 years ago

If scammers can get people to open the developer console and paste code, they can get them to install the "developer tools extension" and then open the console and paste code. Add all the warnings you want, the scammer will say "see what facebook doesn't want you to see!!!".

This has been called the "dancing monkeys problem". People can really be manipulated into doing anything in order to see the dancing monkeys (even if they couldn't be convinced to do those things for constructive purposes).

IMHO you just can't save people from themselves, might as well stop trying and making my life harder.

TeMPOraL2• 12 years ago

We can put bareers here forever that will deter more and more developers and curious yet-to-be hackers from playing with the web, while scammers will just use simple social tricks to make gullible people jump through any obstacle we put.

Here, to be honest, I vote for natural selection. Fight the scammers, and let the gullible be scammed until the society develops an immune response. It happens all the times, and I think that at least a part of the solution for Internet scam is to accelerate immune response development as much as possible.

Bahamut• 12 years ago

I would imagine that that would only be activated with a full deployment of FB, so developers wouldn't have to worry about it.

lelf• 12 years ago

Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?

Safari does this

joe_hoyle• 12 years ago

How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?

Strom• 12 years ago

Because pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.

gkhnarik2• 12 years ago

I agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.

nbm• 12 years ago

Have you tried doing that recently? Doesn't work on Firefox and Chrome, not for some time.

azernik• 12 years ago

That is the original exploit mentioned in the accepted answer; however, Firefox and IE have disabled execution of javascript from the address bar, and I assume that Chrome is also moving to do the same thing.

gkhnarik2• 12 years ago

And after that Hackers will start telling people do open their Concole in Developer Tools and paste the code there. I believe many people will do.

yen2232• 12 years ago

There's an interesting link in the accepted answer about how the social engineering hack, that necessitated the disabling of Developer Tools in the first place, was executed in the first place: https://www.facebook.com/photo.php?v=956977232793

magicalist2• 12 years ago

I don't think Developer Tools are going to be able to allow overriding like this for long, or we're going to be seeing a lot of this on sites soon, just like the widespread right-click "disabling" of yesteryear.

brey• 12 years ago

I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset.

I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings.

or hide it behind a turing-test-for-engineers ... 'solve the following code test to enable the dev console' ;)

Already__Taken• 12 years ago

Something something security by obscurity something something.

magicalist2• 12 years ago

Oh, I don't mean for the purposes of security, but sites thinking that they're protecting their content in some way by dropping in a future jquery plugin or whatever that disables the console, and suddenly the hackability and usability of the web becomes much less.

Another place where you see this sort of thing: banks that try to prevent password managers from filling in your credentials (also I've seen a few recently that try to prevent you from pasting in your password).

There is a tradeoff there too: like this Facebook trick helping save some users, bank tricks probably help some users from accidentally saving their bank credentials on some public or shared computer, but it makes it really annoying (or not possible short of opening devtools and setting the input box's value manually) for those of us that want a unique and more-or-less random password for each site we visit.

tokenizerrr2• 12 years ago

Web browsers had had the capability to execute javascript through the URL bar since as long as I can remember. Social engineers should be able to just bypass this by telling users to copy paste the following code, Control+L, type "javascript:" (chrome strips it when copy-pasting), Control+V, Enter.

    javascript:alert('hi ' + document.body.innerHTML);

If people can be tricked into executing code in the dev console, then why not this too?

username42• 12 years ago

I seems too easy to disable developer tools. What about a fork of chrome that prevent disabling this tools

gibybo5• 12 years ago

The accepted answer teases that this is not enough:

  Object.defineProperty(console, '_commandLineAPI',
   { get : function() { throw 'Nooo!' } })

But why isn't it enough?

tshadwell• 12 years ago

Because it is possible to get around with just code: http://escape.alf.nu/20

(which I have done, under another username)

gibybo5• 12 years ago

So how do you get around it? Or, I suppose more importantly, what else do you have to do to prevent people from getting around it?

STRML• 12 years ago

I spent a while looking at it last night and came up with a solution, I'll walk you through it. For reference, here's the code:

    function escape(s) {
      // Bonus level!

      Object.defineProperty(console, 'foo', 
         { get : function() { throw 'nooo!' } });

      var code = 'with(window.console && console.foo || {}) {\n\t'+s+'\n}';
      console.log(code);

      try {
        console.log(eval(code));
      } catch (e) {
        console.log(e);
      }
    }

The idea is, you need to craft `s`, such that `s` can execute arbitrary code without throwing 'nooo!'. The interesting problem is, any access to `console.foo` with throw because the getter above is called. This includes the access inside the `with` statement. So the solution, if there is any, must somehow cause mutation of state before the `with` even executes.

Now, what brought me to the solution was this thought: "What in Javascript allows you to execute code before a given statement?" Upon framing it in this way, the solution became immediately clear: function declarations are automatically hoisted!

If you redefine `console` to be an object without the property 'foo', the `|| {}` part of the with predicate will instead be passed as the scope, and you have free reign to walk about the system.

So the solution is:

    alert(1) } function console(){} {

Which produces the statement:

    with(window.console && console.foo || {}) { 
      alert(1) } function console(){} {
    }

gibybo5• 12 years ago

Ah, very clever, thanks :)

pjob• 12 years ago

Ah, cool. That's a little shorter than the solution that I came up with:

  function window(){alert(1)}window()

To those of you going for the code golf record, you can save a character in STRML's solution by redefining window instead. Furthermore, the last two braces can be omitted and whitespace removed for a total of 27 characters.

ibarrajo• 12 years ago

This is an analysis of the code that facebook is trying to prevent from being pasted into the console

http://pastebin.com/0JXCVxXg

agumonkey2• 12 years ago

I thought it was obfuscated variable names, but it's a turkish word https://en.wiktionary.org/wiki/arkada%C5%9Flar (follower)

egeozcan• 12 years ago

It means "friends". There are some functions named "get messages", "get friends", "get a random friend" and "post comment" too. Weird.

Fasebook2• 12 years ago

This is a pretty good reason to never trust Chrome again.

nyrina• 12 years ago

I wouldn't trust any computer, then.

It's the same as taking a bunch of code you have no idea how works, and paste it into CMD, then wondering why you just deleted C:/

Sharlin• 12 years ago

I would indeed not trust any OS that allows you to erase the root filesystem without at least asking for the superuser password :)

talkingquickly• 12 years ago

Exactly, how many developers can honestly say they've never copy pasted commands into the terminal without being 100% sure what they were doing?

Fasebook2• 12 years ago

So you're fine with Google allowing coders to change the function of the dev console? Interesting...

zachrose• 12 years ago

How is this "browser vulnerability" different from a bookmarklet?

hrjet• 12 years ago

Or a browser extension.

blueskin_• 12 years ago

Doesn't happen for me in Firefox - I can make alerts etc using the console.

jokoon• 12 years ago

I hate the web

phaer• 12 years ago

Wouldn't it be just as simple for an attacker to persuade a victim to paste a string starting with "javascript:" into the URL bar?

Cyykratahk• 12 years ago

Both FireFox and Chrome have been preventing that since around 2011; the pasted url is stripped of the "javascript:" part. But now the malicious instructions tell users to press "j" before pasting the url (which is missing the "j" at the start), which prevents the browsers from detecting and stripping the protocol, thus allowing the script execution.

darkbot• 12 years ago

Facebook is violating the user's right to their own software.

ceejayoz• 12 years ago

Facebook is protecting the vast majority of users and making developers click a checkbox to undo that protection. There are plenty of things to get outraged about, but I'd argue this isn't one of them.

krrishd• 12 years ago

http://Facebook.com/selfxss is all it really takes.

WithTeeth• 12 years ago

I think the burden lies on the browsers to warn average users of the danger of pasting javascript code. Perhaps a popup confirmation the first time you paste `javascript:...` in the address bar with a "Never ask again," and a warning that "Here be danger" when you open the dev console that you can dismiss.

How does Facebook disable Developer Tools?

Related Stories