“Let The Hacking Begin” Declares Person Who Hacked Zuckerberg’s Facebook Page | Hacker News Reader

“Let The Hacking Begin” Declares Person Who Hacked Zuckerberg’s Facebook Page

techcrunch.com

72 pointsremi34 comments

If facebook needs money, instead of going to the banks, why doesn’t Facebook let its users invest in Facebook in a social way?

Unnamed hacker reinvents IPO, tells world.

Well, damn, I'm not getting any sleep tonight. That's brilliant, I'll have to find a way to make it work.

I think that's already been invented in several forms:

Here's 2

a) Users donate money, a la wikipedia (except with FB they can advertise that they are great people and donated, thereby encouraging others to donate)

b) Users pay for access, subscription or some such. If it's optional, paying users get perks (more space for photos, searches across the graph, etc.)

There were also several startups that gave out shares to their users during the last boom.

I read it as suggesting the above - just give each facebook user a few shares in facebook.

Here's what a commenter, DogGunn, had to say (I copy below as I'm not sure it'll stay at the top):

"Article is wrong.

Mark's profile is here: http://www.facebook.com/zuck

And his like page is here: http://www.facebook.com/pages/...

Neither were hacked.

Someone had setup a fake profile at http://www.facebook.com/markzu... and fooled Techcrunch. Facebook fixed by deleting the fake profile."

A quick copy+paste pretty much confirmed it for me.

Anyone else notice that the headline authoritatively declares that it was a hack, then the article copy indicates that they're not sure?

Shocker, right?

Very interesting -- I wonder if this is the result of having so many API access points. The documentation page lists FBML+FQL, Graph, "Old Rest API", and "Old Javascript Client Library" as options: http://developers.facebook.com/docs/ Or are we back to good old XSS attacks?

here's a direct link to where the short url was pointed: http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e4...

  http://en.wikipedia.org/wiki/Social_business?h=d044aeb71f4e466a552708fc6e3863ef&thanksforthecup=https://www.facebook.com/photo.php%3Fpid%3D393752%26id%3D133954286636768%26fbid%3D170535036312026

I bet Mark Zuckerberg made that post, masquerading as a hacker. It wouldn't be the first time he's pretended to be one.

Jealous?

Clearly.

I wonder what HNers think is the way that this was done?

I wouldn't rule out some guy following Zuck around Palo Alto with airtools and hijacking cookies.

It would be rather poetic if he just used firesheep, but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. Possible, but unlikely.

With apps on both the iPhone and Android wouldn't it be possible for his phone to poll the FB site in the background without his knowledge?

EDIT

I know 3G is encrypted. What I'm wondering though is if you ever let your phone join an unencrypted wifi network (say at a coffee shop) would it remember the network and then join again automatically the next time you are there?

3G is encrypted [1], so it would still have to be on an open wifi.

[1] http://en.wikipedia.org/wiki/3g#Security

Zuckerberg's probably got an iPhone, and 3G GSM encryption's been cracked: http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked...

I'd be interested to see if an optimized implementation of that attack could be run in a convenient timeframe for a cafe-sniffing attack. The article you linked mentioned a 2 hour attack window; something in the sub-15 minute range would be a pressing concern.

Only something in the sub-15 minute range would be a concern for you or me, but don't forget that this is Zuckerberg - it's not at all impossible that someone followed him around for 2 hours to crack his GSM encryption.

Possibly. Worth an experiment, at any rate. I suspect the behaviour in question would depend upon the phone, unless the iOS/Android/BB apps are all functionally the same.

> but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless.

He'd just have to be logged in, not specifically accessing his fan page, and there's a nice Starbucks near the Facebook campus in Palo Alto that has free (unencrypted) wifi. Or maybe that's all Starbucks these days...

Does facebook use captchas, to slow bruteforcing, I tried entering a few wrong passwords for my account but didn't get one. However I doubt that bruteforcing or a dictionary attack was used.

facebook doesn't use captcha's as much as it does other security features. if there is a log-in from an ip address that seems suspicious, it can ask you to identify your friends in photos to verify your identity.

Which is actually so much less annoying than captcha. Seems less secure (probably trivial for people you know to break in) but it's certainly a novel approach.

captchas really aren't particularly suited to the task. The difference between even the most forgetful user and the lowest key bruteforce is so many orders of magnitude that it should be trivial to detect. I have no idea what facebook does, but most services just make it too slow to be practical: progressively slower responses, rate limiting, lockout periods. Another approach is to fail all authentications over a rate limit so that even if the correct password is guessed the attacker doesn't know. Long story short is defending a service against brute forcing is generally pretty easy.

Firesheep.

The way iFrames are used by so many 3rd party sites to pull in likes, you don't even need to be on Facebook to be vulnerable.

That's why I only use Chrome to browse Facebook, and use Firefox with NoScript for everything else.

And I regularly completely wipe personal data from Chrome (which interestingly doesn't give a mechanism to delete cookies on a per-site basis.)

Chrome does let you delete individual cookies and other data for sites.

Preferences -> Under the Hood -> Content Settings -> All Cookies and Other Data -> search for site and hit remove.

This is with the dev channel version of Chrome.

Ah. I guess it's always been there. I was just expecting the title to match Firefox's "remove individual cookies." Reminds me of the "Add/Remove Programs" -> "Programs and Features" switch between XP and Vista.

Nine times out of ten a targeted intrusion like this will have been the result of a spearphishing attack - malicious pdf, malicious link etc sent directly to a small chosen set of people.

I'm not personally familiar with how a high traffic fan page like this is managed, but I guess a fair number of people have access to it to delete spam, forward on interesting messages etc. It seems to me that a lot of those people might have the technical ability to post a new message - they may just be constrained by policy. So that's perhaps dozens of potential unsophisticated targets - interns, junior PR staffers. Like shooting fish in a barrel.

Drunk intern that left three months ago and no password change policy on the account (*which I assume is used by the PR department, not Zuckerberg himself) .

I think everyone here is overthinking it.

He probably just left his account logged in at a friend's house.

Target: the moderators/judges of the facebook coding contest

Approach: post links on the contest page to a site that claims to know future questions, write code for you, process your data whatever. They'll get deleted but some staff will inevitably want to check if it's legit.

Method: Today's money is on the IE CSS use after free bug - unpatched and widely available. Get some ie traffic by "this site requires Internet Explorer". Some other month it'd be a jre/flash/quicktime/pdf.

Execution: Transitory system access on one or more clients. Reverse shell or basic payload, good rootkits are expensive. Simplest is just copy cookies/autofills/saved passwords/ssh keys - for extra credit install a keylogger.

Low and behold, poorly_paid_intern not only despams the contest page but does the same for zuck's pr account.

IMO not a local wireless attack - who on the peninsula would have such a idealized view of facebook's financing? Also US citizen+high profile=bad idea, see doing a year for guessing Sarah's yahoo.

The social business model http://www.youtube.com/watch?v=0C3XQ3BTd4o

Reply on news.ycombinator.com