6 ms·

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner

by mkjones 14y ago

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would need to have been posted online (e.g. via throwaway email sites, as someone pointed out - or people whose email addresses go to email lists with online archives). As jpadvo surmised, the nonces expire after a period of time. They also only work for certain users, and even then we run additional security checks to make sure it looks like the account owner who's logging in. Regardless, due to some of these links being disclosed, we've turned the feature off until we can better ensure its security for users whose email contents are publicly visible. We are also securing the accounts of anyone who recently logged in through this flow. In the future if you run into something that looks like a security problem with Facebook, feel free to disclose it responsibly through our whitehat program: https://www.facebook.com/whitehat https://www.facebook.com/whitehat. That way, in addition to making some money, you can avoid a bunch of script kiddies exploiting whatever the issue is that you've found.

pgl 14y ago
Sorry, but, where does it mention anything about making money for reporting security vulnerabilities on https://www.facebook.com/whitehat https://www.facebook.com/whitehat?
- chucknthem 14y ago
  https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/
- mkjones 14y ago
  Yep as chucknthem points out, try clicking the "bounty" on the left side: https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/. Sorry I didn't make that clearer!
credo 14y ago
You mention that the nonces expire after a period of time. If you don't plan on cutting the feature for ever, perhaps you could consider an alternative approach of limiting the validity of the URLs to the first visit and also removing the email-id (and other PII data) of the user from the URL.
- acqq 14y ago
  The feature is absolutely too dangerous to ever have existed! It turns out that Facebook implemented the plain links that are more powerful than the password reset procedures, considering the easiness in taking over the account of another user. Having the actual user id in the link is just a small topping on that cake, not even worth to discuss as long as the "no login just click the link" possibility remains to exist.
- gcorne 14y ago
  When did the term "nonce" start being used in web application development to refer to a token that expires after a period of time instead of being a true one-time use number/token? http://en.wikipedia.org/wiki/Cryptographic_nonce http://en.wikipedia.org/wiki/Cryptographic_nonce
  - durin42 14y ago
    They could both be one-time-use nonces and additionally have an expiration date. That was how I read the statement, but maybe that was generous.
  - Evbn 14y ago
    Nonces are one time use in webapps, unless bad bug.
    - gcorne 14y ago
      WordPress uses them in a similar way to how it sounds like Facebook is using them. I wonder how many others are misusing the term.
lazyjones 14y ago
The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.
- credo 14y ago
  (Regardless of whether one has a Facebook account or not) If your theory is correct, this seems like a good reason to not use Chrome or any browser with a Google Toolbar :)
  - brudgers 14y ago
    Another good reason.
- wesley 14y ago
  Wouldn't a proper robots.txt rule fix this?
  - mkjones 14y ago
    A robots.txt file disallowing crawling on the sites that display the contents of user email would help fix this. However, as some of the discussion below points out, I don't believe that disallowing crawling of these URLs in our robots.txt would keep them from the index if a search engine finds reference to them elsewhere; I think it simply keeps them from being crawled.
- mkjones 14y ago
  I'm not sure either, but I doubt that Chrome or any of the badware-stopping features that are built in to it cause the URLs they're checking to be indexed. I'd be even more surprised if Firefox did this. If you've got the toolbar installed though, I'd be less surprised if they tried crawling or indexing URLs you go to. EDIT: It looks like they've explicitly said the toolbar does not cause things to appear in search results: http://www.seroundtable.com/google-toolbar-indexing-12894.html http://www.seroundtable.com/google-toolbar-indexing-12894.ht....
nico-roddz 14y ago
Thanks Matt, My only concern is my account security (not money). I found this issue with almost no technical knowledge, so the crazy thing is: How many back doors should be over there ready to be exploited by spammers? BTW, a big "report security issue" button on https://www.facebook.com/help/ https://www.facebook.com/help/ would certainly help next time. Thanks again, Nico
- eli 14y ago
  It shouldn't take you more than one Google query to find the place to report Facebook security problems. I don't think it's a good idea to link it from the general support section -- you don't want the security team that is hopefully carefully monitoring this stuff to have to wade through thousands of regular customer service complaints.
  - engtech 14y ago
    It shouldn't... but it could be easier. I've been in the situation before where I wanted to report malware on facebook and I couldn't figure out where to report it. I agree that you don't want reporting a security issue to supersede the general case of problems, but as things stand it is hard to figure out how to report a real security issue if you don't know about that magic whitehat url. Googling "facebook security" brings #1 result: https://www.facebook.com/security https://www.facebook.com/security no information on reporting problems there #2 result: https://www.facebook.com/help/security https://www.facebook.com/help/security this one has a Report Something link... but that doesn't give you options for reporting a security issue, just TOS violations or copyright infringement. #3 result: https://www.facebook.com/security/app_10442206389 https://www.facebook.com/security/app_10442206389 This looks better than the other two, but there is still nothing here about how to report a security issue. Knowing what to look for, there's a hidden "Take Action >> White Hats" link that will eventually take you to the correct page: https://www.facebook.com/security/app_6009294086 https://www.facebook.com/security/app_6009294086 So click that link... and presented with a huge page of names and still no obvious call to action: https://www.facebook.com/whitehat https://www.facebook.com/whitehat Oh, it's the Report Vulnerability link in that sidebar that we're been conditioned to ignore in the normal Facebook UI. https://www.facebook.com/whitehat/report/ https://www.facebook.com/whitehat/report/ --- Just to recap, in order to find how to submit a security bug report, it took me 15 minutes and I still only found it because I knew the term to look for was "white hat" and not "security".
elliotanderson 14y ago
Would Facebook ever consider having the option of two factor authentication (something similar, if not compatible with Google Authentication/TOTP/MOTP apps)?
- julien_c 14y ago
  It does, and I'm using it.
- leonkenneth 14y ago
  Actually it already has, see http://www.facebook.com/note.php?note_id=10150172618258920 http://www.facebook.com/note.php?note_id=10150172618258920.
  - mpyne 14y ago
    I use it too, but I must admit to wishing they would make it compatible with Google Authenticator or some other OATH implementation. SMS'ed text codes take way too long to be a good second-step when you're having to login everyday like I do (not to mention logging in from work where my reception is almost nil).
    - abraham 14y ago
      I can't speak for the iOS app but the Android app will generate tokens.
    - mkjones 14y ago
      We're working on improving this flow. However, if you tell us to trust a given computer when you log in, you shouldn't have to enter the code more than once.
blauwbilgorgel 14y ago
Since this is already out there as a known issue, and concerns Google too, check out: https://www.google.com/search?q=%22wants+to+be+friends+on+Facebook%22+%22If+you+don%27t+want+to+receive+these+emails+from+Facebook+in+the+future%22 https://www.google.com/search?q=%22wants+to+be+friends+on+Fa... And you'll find at the time of writing 250.000 more results where the "wants to be friends" email with the auto-login link is posted on blogs. Many of these blogs are also hacked, in that they redirect you to Russian dating sites if you visit the homepage. An example of such a blog with password reset email is: http://papajimummyji.blogspot.com/ http://papajimummyji.blogspot.com/ An example of a spam-redirecting blog is: http://demiansyahhh.blogspot.com/ http://demiansyahhh.blogspot.com/ (possibly unsafe) For some more Facebook reset emails see: https://www.google.com/search?q=%22You+recently+asked+to+reset+your+Facebook+password.%22+%22this+message+was+sent+to%22 https://www.google.com/search?q=%22You+recently+asked+to+res... EDIT: Twitter emails are also exposed: https://www.google.com/search?q=%22Forgot+your+Twitter+password%3F+Get+instructions+on+how+to+reset+it.%22+site%3Ablogspot.com https://www.google.com/search?q=%22Forgot+your+Twitter+passw... Youtube emails: https://www.google.com/search?q=%22YouTube+sends+email+summaries+like+these+so+you+can+keep+up+with+your+channel+subscriptions.%22+site%3Ablogspot.com https://www.google.com/search?q=%22YouTube+sends+email+summa... Twoo emails: https://www.google.nl/search?q=%22Massive+Media+NV%2C+Emile+Braunplein+18%2C+9000+Ghent%2C+Belgium+BE0834322338%22+site%3Ablogspot.com https://www.google.nl/search?q=%22Massive+Media+NV%2C+Emile+... And likely more web services.
- windsurfer 14y ago
  It's 47 minutes later and for your searches, I'm seeing 5 results and 309 results. Spooky.
  - shiftpgdn 14y ago
    Somebody at the Google is certainly watching this thread and cleaning house.
  - blauwbilgorgel 14y ago
    Yeah that was weird. I found another that still returns 233.000 results for me: https://www.google.com/search?q=%22wants+to+be+friends%22+%22facebook%22+%22If+you+don%27t+want+to+receive%22+site:blogspot.com https://www.google.com/search?q=%22wants+to+be+friends%22+%2... I must have made a typo at "don%27t". I corrected the first query and it now returns 238.000 results for me again. Perhaps some Blogspot sites got hacked/ their users phished (I noticed suspicious posting activity dating back to November 2011), which would explain how they got access to the emails. Or these accounts are all fake (selling likes) and they use Blogspot to create online persona's and manage their accounts.
Omegador 14y ago
That page doesn't say anything about money. It says Facebook might decide not to sue you submit it.
- mkjones 14y ago
  https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/ describes our bug bounty program, linked to from the "bounty" tab on the left of https://www.facebook.com/whitehat/ https://www.facebook.com/whitehat/.
deleted 14y ago
[deleted]
gonzac 14y ago
I discovered this a long time ago, and I denounced this In this post you can see http://gonzac-studios.blogspot.com.ar/2012/02/hack-la-vulnerabilidad-que-facebook-no.html http://gonzac-studios.blogspot.com.ar/2012/02/hack-la-vulner...
lightj 14y ago
Hi, My account was hacked at the weekend and although it is locked the person still keeps changing my password and I am not able to get into it. it wont let me reset my password as keeps coming up with an error message. I need this sorted and have had no help from fb even after reporting it numerous times
Null00 14y ago
My name is Jared Null, and I first reported this as a vulnerability back in March to the bug bounty program. I've posted one conversation here: http://news.cnet.com/8301-1023_3-57544933-93/facebook-password-bypass-flaw-fixed/ http://news.cnet.com/8301-1023_3-57544933-93/facebook-passwo.... I'm confused, you say that its not a vulnerability, yet Facebook had to take action. I guess seeing is believing and it only took a public disclosure to see the light. The sad thing is I reported both the recover password link and the checkpoint link "https://www.facebook.com/checkpoint/checkpointme?u= https://www.facebook.com/checkpoint/checkpointme?u= (which by the way is still vulnerable), the checkpoint links are reusable but the recover password links were one time use. Jared Null WhiteHat Security

by mkjones 14y ago

pgl 14y ago

Sorry, but, where does it mention anything about making money for reporting security vulnerabilities on https://www.facebook.com/whitehat https://www.facebook.com/whitehat?

chucknthem 14y ago
https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/
mkjones 14y ago
Yep as chucknthem points out, try clicking the "bounty" on the left side: https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/. Sorry I didn't make that clearer!

credo 14y ago

You mention that the nonces expire after a period of time. If you don't plan on cutting the feature for ever, perhaps you could consider an alternative approach of limiting the validity of the URLs to the first visit and also removing the email-id (and other PII data) of the user from the URL.

acqq 14y ago
The feature is absolutely too dangerous to ever have existed! It turns out that Facebook implemented the plain links that are more powerful than the password reset procedures, considering the easiness in taking over the account of another user. Having the actual user id in the link is just a small topping on that cake, not even worth to discuss as long as the "no login just click the link" possibility remains to exist.
gcorne 14y ago
When did the term "nonce" start being used in web application development to refer to a token that expires after a period of time instead of being a true one-time use number/token? http://en.wikipedia.org/wiki/Cryptographic_nonce http://en.wikipedia.org/wiki/Cryptographic_nonce
- durin42 14y ago
  They could both be one-time-use nonces and additionally have an expiration date. That was how I read the statement, but maybe that was generous.
- Evbn 14y ago
  Nonces are one time use in webapps, unless bad bug.
  - gcorne 14y ago
    WordPress uses them in a similar way to how it sounds like Facebook is using them. I wonder how many others are misusing the term.

lazyjones 14y ago

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

credo 14y ago
(Regardless of whether one has a Facebook account or not) If your theory is correct, this seems like a good reason to not use Chrome or any browser with a Google Toolbar :)
- brudgers 14y ago
  Another good reason.
wesley 14y ago
Wouldn't a proper robots.txt rule fix this?
- mkjones 14y ago
  A robots.txt file disallowing crawling on the sites that display the contents of user email would help fix this. However, as some of the discussion below points out, I don't believe that disallowing crawling of these URLs in our robots.txt would keep them from the index if a search engine finds reference to them elsewhere; I think it simply keeps them from being crawled.
mkjones 14y ago
I'm not sure either, but I doubt that Chrome or any of the badware-stopping features that are built in to it cause the URLs they're checking to be indexed. I'd be even more surprised if Firefox did this. If you've got the toolbar installed though, I'd be less surprised if they tried crawling or indexing URLs you go to. EDIT: It looks like they've explicitly said the toolbar does not cause things to appear in search results: http://www.seroundtable.com/google-toolbar-indexing-12894.html http://www.seroundtable.com/google-toolbar-indexing-12894.ht....

nico-roddz 14y ago

Thanks Matt, My only concern is my account security (not money). I found this issue with almost no technical knowledge, so the crazy thing is: How many back doors should be over there ready to be exploited by spammers? BTW, a big "report security issue" button on https://www.facebook.com/help/ https://www.facebook.com/help/ would certainly help next time. Thanks again, Nico

eli 14y ago
It shouldn't take you more than one Google query to find the place to report Facebook security problems. I don't think it's a good idea to link it from the general support section -- you don't want the security team that is hopefully carefully monitoring this stuff to have to wade through thousands of regular customer service complaints.
- engtech 14y ago
  It shouldn't... but it could be easier. I've been in the situation before where I wanted to report malware on facebook and I couldn't figure out where to report it. I agree that you don't want reporting a security issue to supersede the general case of problems, but as things stand it is hard to figure out how to report a real security issue if you don't know about that magic whitehat url. Googling "facebook security" brings #1 result: https://www.facebook.com/security https://www.facebook.com/security no information on reporting problems there #2 result: https://www.facebook.com/help/security https://www.facebook.com/help/security this one has a Report Something link... but that doesn't give you options for reporting a security issue, just TOS violations or copyright infringement. #3 result: https://www.facebook.com/security/app_10442206389 https://www.facebook.com/security/app_10442206389 This looks better than the other two, but there is still nothing here about how to report a security issue. Knowing what to look for, there's a hidden "Take Action >> White Hats" link that will eventually take you to the correct page: https://www.facebook.com/security/app_6009294086 https://www.facebook.com/security/app_6009294086 So click that link... and presented with a huge page of names and still no obvious call to action: https://www.facebook.com/whitehat https://www.facebook.com/whitehat Oh, it's the Report Vulnerability link in that sidebar that we're been conditioned to ignore in the normal Facebook UI. https://www.facebook.com/whitehat/report/ https://www.facebook.com/whitehat/report/ --- Just to recap, in order to find how to submit a security bug report, it took me 15 minutes and I still only found it because I knew the term to look for was "white hat" and not "security".

elliotanderson 14y ago

Would Facebook ever consider having the option of two factor authentication (something similar, if not compatible with Google Authentication/TOTP/MOTP apps)?

julien_c 14y ago
It does, and I'm using it.
leonkenneth 14y ago
Actually it already has, see http://www.facebook.com/note.php?note_id=10150172618258920 http://www.facebook.com/note.php?note_id=10150172618258920.
- mpyne 14y ago
  I use it too, but I must admit to wishing they would make it compatible with Google Authenticator or some other OATH implementation. SMS'ed text codes take way too long to be a good second-step when you're having to login everyday like I do (not to mention logging in from work where my reception is almost nil).
  - abraham 14y ago
    I can't speak for the iOS app but the Android app will generate tokens.
  - mkjones 14y ago
    We're working on improving this flow. However, if you tell us to trust a given computer when you log in, you shouldn't have to enter the code more than once.

blauwbilgorgel 14y ago

Since this is already out there as a known issue, and concerns Google too, check out: https://www.google.com/search?q=%22wants+to+be+friends+on+Facebook%22+%22If+you+don%27t+want+to+receive+these+emails+from+Facebook+in+the+future%22 https://www.google.com/search?q=%22wants+to+be+friends+on+Fa... And you'll find at the time of writing 250.000 more results where the "wants to be friends" email with the auto-login link is posted on blogs. Many of these blogs are also hacked, in that they redirect you to Russian dating sites if you visit the homepage. An example of such a blog with password reset email is: http://papajimummyji.blogspot.com/ http://papajimummyji.blogspot.com/ An example of a spam-redirecting blog is: http://demiansyahhh.blogspot.com/ http://demiansyahhh.blogspot.com/ (possibly unsafe) For some more Facebook reset emails see: https://www.google.com/search?q=%22You+recently+asked+to+reset+your+Facebook+password.%22+%22this+message+was+sent+to%22 https://www.google.com/search?q=%22You+recently+asked+to+res... EDIT: Twitter emails are also exposed: https://www.google.com/search?q=%22Forgot+your+Twitter+password%3F+Get+instructions+on+how+to+reset+it.%22+site%3Ablogspot.com https://www.google.com/search?q=%22Forgot+your+Twitter+passw... Youtube emails: https://www.google.com/search?q=%22YouTube+sends+email+summaries+like+these+so+you+can+keep+up+with+your+channel+subscriptions.%22+site%3Ablogspot.com https://www.google.com/search?q=%22YouTube+sends+email+summa... Twoo emails: https://www.google.nl/search?q=%22Massive+Media+NV%2C+Emile+Braunplein+18%2C+9000+Ghent%2C+Belgium+BE0834322338%22+site%3Ablogspot.com https://www.google.nl/search?q=%22Massive+Media+NV%2C+Emile+... And likely more web services.

windsurfer 14y ago
It's 47 minutes later and for your searches, I'm seeing 5 results and 309 results. Spooky.
- shiftpgdn 14y ago
  Somebody at the Google is certainly watching this thread and cleaning house.
- blauwbilgorgel 14y ago
  Yeah that was weird. I found another that still returns 233.000 results for me: https://www.google.com/search?q=%22wants+to+be+friends%22+%22facebook%22+%22If+you+don%27t+want+to+receive%22+site:blogspot.com https://www.google.com/search?q=%22wants+to+be+friends%22+%2... I must have made a typo at "don%27t". I corrected the first query and it now returns 238.000 results for me again. Perhaps some Blogspot sites got hacked/ their users phished (I noticed suspicious posting activity dating back to November 2011), which would explain how they got access to the emails. Or these accounts are all fake (selling likes) and they use Blogspot to create online persona's and manage their accounts.

Omegador 14y ago

That page doesn't say anything about money. It says Facebook might decide not to sue you submit it.

mkjones 14y ago
https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/ describes our bug bounty program, linked to from the "bounty" tab on the left of https://www.facebook.com/whitehat/ https://www.facebook.com/whitehat/.

deleted 14y ago

[deleted]

gonzac 14y ago

I discovered this a long time ago, and I denounced this In this post you can see http://gonzac-studios.blogspot.com.ar/2012/02/hack-la-vulnerabilidad-que-facebook-no.html http://gonzac-studios.blogspot.com.ar/2012/02/hack-la-vulner...

lightj 14y ago

Hi, My account was hacked at the weekend and although it is locked the person still keeps changing my password and I am not able to get into it. it wont let me reset my password as keeps coming up with an error message. I need this sorted and have had no help from fb even after reporting it numerous times

Null00 14y ago

My name is Jared Null, and I first reported this as a vulnerability back in March to the bug bounty program. I've posted one conversation here: http://news.cnet.com/8301-1023_3-57544933-93/facebook-password-bypass-flaw-fixed/ http://news.cnet.com/8301-1023_3-57544933-93/facebook-passwo.... I'm confused, you say that its not a vulnerability, yet Facebook had to take action. I guess seeing is believing and it only took a public disclosure to see the light. The sad thing is I reported both the recover password link and the checkpoint link "https://www.facebook.com/checkpoint/checkpointme?u= https://www.facebook.com/checkpoint/checkpointme?u= (which by the way is still vulnerable), the checkpoint links are reusable but the recover password links were one time use. Jared Null WhiteHat Security