full-disclosure - Re: Facebook Attach EXE Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABgawuYGTu1=eG2NEsD9g_n_aaPWE1myQzrZNc0TDZ5sqsb2VQ@mail.gmail.com>
Date: Mon, 31 Oct 2011 10:40:24 -0400
From: Charles Morris <cmorris@...odu.edu>
To: Nathan Power <np@...uritypentest.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Facebook Attach EXE Vulnerability

Nathan, It IS an issue, don't let their foolishness harsh your mellow.

Although it's a completely ridiculous, backwards, and
standards-relaxing "security" mechanism,
the fact is they implemented it, and you subverted it.

In my book that's Pentester 1 :: Fail Vendor 0

I've had large vendors (read:Microsoft) reply to issues with the same
kind of garbage,
where they take a situation where there wasn't a threat, create a
"security" mechanism
to counter the nonexistent threat, then implement it incorrectly, thus
creating either
a vulnerability in the system itself or a false sense of security for the user.

Fail: "Hello user, you can add attachments now! Look at our amazing
1997 web technology!!"

User: "Oh neat, I can't wait to send my friend this random file (read:
give up your rights and control of your random file to facebook) your
through your excessive, unnecessary, inefficient, insecure,
closed-source tool"

Fail: "I am blocking exe attachments 'for your security' so feel free
to just run attachments without a second thought, don't even bother to
waste 100ns of your time to practice normal security"

User: "Wait, what about .bat, .cmd, .vbs, .ws, .pif, .inx, .lnk etc
etc? What about the extensions that I set up? Can I really just spam
clicks all over the place?"

Fail: "Oh those, well you shouldn't be clicking those. What, we can't
be held responsible if you don't practice normal security!! P.S. You
know when we said we were blocking .exe files? Well--- we aren't.
Enjoy."

</rant>

On Fri, Oct 28, 2011 at 1:38 PM, Nathan Power <np@...uritypentest.com> wrote:
> I was basically told that Facebook didn't see it as an issue and I was
> puzzled by that. Ends up the Facebook security team had issues reproducing
> my work and that's why they initially disgarded it. After publishing, the
> Facebook security team re-examined the issue and by working with me they
> seem to have been able to reproduce the bug.
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/