Full Disclosure mailing list archives
Re: Facebook Attach EXE Vulnerability
From: Charles Morris <cmorris () cs odu edu>
Date: Mon, 31 Oct 2011 10:40:24 -0400
Nathan, It IS an issue, don't let their foolishness harsh your mellow. Although it's a completely ridiculous, backwards, and standards-relaxing "security" mechanism, the fact is they implemented it, and you subverted it. In my book that's Pentester 1 :: Fail Vendor 0 I've had large vendors (read:Microsoft) reply to issues with the same kind of garbage, where they take a situation where there wasn't a threat, create a "security" mechanism to counter the nonexistent threat, then implement it incorrectly, thus creating either a vulnerability in the system itself or a false sense of security for the user. Fail: "Hello user, you can add attachments now! Look at our amazing 1997 web technology!!" User: "Oh neat, I can't wait to send my friend this random file (read: give up your rights and control of your random file to facebook) your through your excessive, unnecessary, inefficient, insecure, closed-source tool" Fail: "I am blocking exe attachments 'for your security' so feel free to just run attachments without a second thought, don't even bother to waste 100ns of your time to practice normal security" User: "Wait, what about .bat, .cmd, .vbs, .ws, .pif, .inx, .lnk etc etc? What about the extensions that I set up? Can I really just spam clicks all over the place?" Fail: "Oh those, well you shouldn't be clicking those. What, we can't be held responsible if you don't practice normal security!! P.S. You know when we said we were blocking .exe files? Well--- we aren't. Enjoy." </rant> On Fri, Oct 28, 2011 at 1:38 PM, Nathan Power <np () securitypentest com> wrote:
I was basically told that Facebook didn't see it as an issue and I was puzzled by that. Ends up the Facebook security team had issues reproducing my work and that's why they initially disgarded it. After publishing, the Facebook security team re-examined the issue and by working with me they seem to have been able to reproduce the bug.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Facebook Attach EXE Vulnerability, (continued)
- Re: Facebook Attach EXE Vulnerability Nathan Power (Oct 28)
- Re: Facebook Attach EXE Vulnerability Ulises2k (Oct 28)
- Re: Facebook Attach EXE Vulnerability Laurelai (Oct 28)
- Re: Facebook Attach EXE Vulnerability Valdis . Kletnieks (Oct 28)
- Re: Facebook Attach EXE Vulnerability Laurelai (Oct 28)
- Re: Facebook Attach EXE Vulnerability Jeffrey Walton (Oct 28)
- Re: Facebook Attach EXE Vulnerability Nathan Power (Oct 29)
- Re: Facebook Attach EXE Vulnerability xD 0x41 (Oct 29)
- Re: Facebook Attach EXE Vulnerability Chris Evans (Oct 30)
- Re: Facebook Attach EXE Vulnerability xD 0x41 (Oct 31)
- Re: Facebook Attach EXE Vulnerability Charles Morris (Oct 31)
- Re: Facebook Attach EXE Vulnerability Vipul Agarwal (Oct 28)
- Re: Facebook Attach EXE Vulnerability fengclient (Oct 28)