Facebook blames Zuckerberg embarrassment on API 'bug' | Hacker News Reader

Facebook blames Zuckerberg embarrassment on API 'bug'

networkworld.com

25 pointstaylorbuley17 comments

Firesheep, which allows people worldwide to steal other people's Facebook passwords over public wifi, comes out in October and they still don't redirect to https login by default. Zukerburg's fan page gets hacked with a message pertaining to Facebook's investors and they close the loophole that allowed it to happen in 1 day. Of course.

It's not a "loophole"; it's a critical vulnerability in their API server. It doesn't just affect Zuckerberg.

I think the point is that FB did nothing until it hit close to home and was embarrassing to their brand.

The https rollout you're referring to had nothing to do with the Zuckerberg hack, there were people testing it before the incident. It's a coincidence and has nothing to do with what happened with Zuckerberg's fan page, do you really think he went to coffee shop and logged into his fan page???

Fan pages don't work like that, at least not for normal users. Unless they have some special authentication system set up for Zuck's personal page, someone gaining access to his Facebook account should gain access to his fan page.

Or if his personal account is not an admin on the page, but again I find that unlikely.

Still, I believe them when they say it was an API bug. I don't see why they would lie and claim it was something else on the day they roll out a fix for the problem.

Firesheep doesn't steal passwords, it grabs cookies used for authentication. The distinction is important because with firesheep, simply putting your login page on https isn't sufficient.

Stealing passwords is of course also trivial, but to do that you need to force a situation where the user has to actually log in again (see Moxie Marlinspike's sslstrip..., which will nail the majority of people even if the site normally does use https for everything. Really bloody effective.)

Doesn't Facebook have a history of telling us one thing, but actually meaning something else?

Wonder what really happened? Must've been much more embarrassing for them to admit they had an "API Bug".

(I haven't heard of any other accounts being borked via API calls, and developers mess with these thousands of times a day, you're telling me nobody picked up on this...? Except the dude who did a harmless prank on Zuckerbergs page...)

To virtually everybody that pays attention to software security, "bug" and "vulnerability" are synonyms. To everybody that knows how computers work, "bug" is "admission of some degree of fault". This discussion tries to make a mountain out of a molehill.

You haven't heard of any other accounts having weird status updates posted to them? Really? ;)

See http://abcnews.go.com/Technology/wireStory?id=12747194

A bandersnatch ate the anti-hacking chip we'd installed.

http://www.jabberwocky.com/carroll/jabber/jabberwocky.html

Fun poem to memorize

why is admitting to a bug in software embarrassing? suggesting software is bug-free is practically oxymoronic.

We'll have to wait for The Social Network 2.

Has Facebook or anybody else said anything about what the underlying bug was? Missing permission check, incorrect logic, problem in error condition ... ? Their security model is so complex that I'd expect the code to be a nightmare ... and they introduce functionality at such a fast pace

"...an API "bug" that allowed unauthorized persons to post not only on his page but those of an undisclosed number of other users." [read: a lot of other users]

That sentence was written by the author of the article: it doesn't appear to be based on what people actually said. The quote from Facebook is "A bug enabled status postings by unauthorized people on a handful of public pages. The bug has been fixed."

Of course, we have to keep in mind that Facebook has an incentive to downplay the severity and the author has an incentive to hype the severity; the truth is probably somewhere in the middle. There's no reason to believe that there was mass-abuse of this issue unless someone has evidence to the contrary. At the same time, Zuckerberg's wasn't the only high profile page to have a strange status posted on it recently.

There is no evidence of mass abuse, but that doesn't mean there wasn't the potential for it. If a security hole affected one fan page, it seems likely that it affected every fan page.

Reply on news.ycombinator.com