Re: [Full-disclosure] Facebook Attach EXE Vulnerability

[Charles Morris <cmorris@xxxxxxxxxx>]

Nathan, It IS an issue, don't let their foolishness harsh your mellow.

Although it's a completely ridiculous, backwards, and
standards-relaxing "security" mechanism,
the fact is they implemented it, and you subverted it.

In my book that's Pentester 1 :: Fail Vendor 0

I've had large vendors (read:Microsoft) reply to issues with the same
kind of garbage,
where they take a situation where there wasn't a threat, create a
"security" mechanism
to counter the nonexistent threat, then implement it incorrectly, thus
creating either
a vulnerability in the system itself or a false sense of security for the user.

Fail: "Hello user, you can add attachments now! Look at our amazing
1997 web technology!!"

User: "Oh neat, I can't wait to send my friend this random file (read:
give up your rights and control of your random file to facebook) your
through your excessive, unnecessary, inefficient, insecure,
closed-source tool"

Fail: "I am blocking exe attachments 'for your security' so feel free
to just run attachments without a second thought, don't even bother to
waste 100ns of your time to practice normal security"

User: "Wait, what about .bat, .cmd, .vbs, .ws, .pif, .inx, .lnk etc
etc? What about the extensions that I set up? Can I really just spam
clicks all over the place?"

Fail: "Oh those, well you shouldn't be clicking those. What, we can't
be held responsible if you don't practice normal security!! P.S. You
know when we said we were blocking .exe files? Well--- we aren't.
Enjoy."

</rant>


On Fri, Oct 28, 2011 at 1:38 PM, Nathan Power <np@xxxxxxxxxxxxxxxxxxx> wrote:
> I was basically told that Facebook didn't see it as an issue and I was
> puzzled by that. Ends up the Facebook security team had issues reproducing
> my work and that's why they initially disgarded it. After publishing, the
> Facebook security team re-examined the issue and by working with me they
> seem to have been able to reproduce the bug.
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/