Hacker News Reader

Comment by testplzignore | Hacker News Reader

> Within two days, we closed the vulnerability

That is very slow for a server-side vulnerability. Was the fix that complicated that it could not be safely deployed within minutes or hours? Or did the FB management not take the issue seriously?

View on HN

I lead Security and Privacy Engineering at Facebook and wanted to chime in on this thread.

As soon as we found the vulnerability, our first priority was to determine how we could protect people most effectively. If we had closed the vulnerability immediately, the attackers could have escalated their attack to modify information or post as someone else by using the access tokens they had already acquired before we reset them. Instead, we determined all the potentially affected accounts and reset their access tokens in a coordinated way to prevent further misuse of the vulnerability.

We haven't reset 90M accounts all at once before. Identifying the attackers, defining our remediation, validating that it would work, and closing the vulnerability while simultaneously ensuring all accounts were secure is complex to do at scale.

>our first priority was to determine how we could protect people most effectively.

You could have taken the site down until it was fixed.

So protecting people was your second priority.

Everything should be in lock down mode while accessing vulnerability and working on a fix.

When you respond like this, you discourage comments like the parent from being posted to HN.

It would be fine if your point was reasonable. But it's not. It's little more than an excuse to hate on Facebook.

He's just tearing down the PR speak.

Yes exactly. A rational response to this is to delete your FB account.

I've been involved in incident response where that was actually the decision made, so this is a real choice (extremely costly, obviously).

Look, I know you are going to get hammered here, but on the off chance you'll see this, can I make a recommendation? You all need to read up on war; because, let's face it, y'all are in one. Here are good starting texts for the cyberwar:

https://www.amazon.com/Art-War-Sun-Tzu/dp/1599869772 (the parts on the type of ground are very good and should be instructive to y'all)

https://www.artofmanliness.com/articles/ooda-loop/ (It seems you guys have been 'looped' pretty badly, this will start the process of fixing that)

https://www.amazon.com/War-Carl-von-Clausewitz/dp/1469947021 (the sections on 'fog of war' should help you all out, the text in general is informative)

Note, that last link is to a crappy "unofficial" copy of the book that looks like it was printed from Notepad; every page has a header of "On War.txt". Do not buy it, it's practically unreadable.

Thanks for the catch!

If you're for real I wonder whether your posting here obeys the company external communication policy :)

Thanks for responding here with your thinking around the issue - I know there's always strong pressure to not engage or that any talking to the public will just backfire/make things worse, but I appreciate the insight into how you're thinking about these things and the complexity around the tradeoffs.

That sounds like a difficult thing to do in under a year. Why push the issue?

Under 2 days is good timing to code, test, and globally deploy a bugfix. The only way to close a hole more quickly is either shut down the system (which might be worse than the bug) or if the bug was extremely recently introduced and you can rollback to a recently tested good version of the system.

> > Within two days, we closed the vulnerability

"Within two days, we closed the vulnerability, stopped the attack, and secured people’s accounts by resetting the access tokens for people who were potentially exposed. As a precaution, we also turned off “View As.”

The last sentence could mean they disabled the feature and then spent two days fixing the vulnerability before re-enabling it. It's not clear though, maybe this is just wishful thinking on my part.

Doesn't the FB deploy process take a day in itself?

Edit: This hasn't been the case for years.

Or were they asked by FBI to keep the thing going’s so they could catch the attacker?

Lots of reasons to delay.

that's not how things work.

Reply on news.ycombinator.com