"FB internal Thrift over HTTP" removed my phone – how is this possible? (2022) | Hacker News Reader

"FB internal Thrift over HTTP" removed my phone – how is this possible? (2022)

old.reddit.com

32 pointsahiknsr15 comments

https://www.facebook.com/hacked/disavow?u=100011623930833&n=...

My guess:

* Some engineer is testing backup/restore of account data, and is running it against production and didn't realise that restoring certain info has side effects of sending out notifications.

Some batch job (incorrectly?) deactivated certain sessions for whatever reason?

Getting "someone ran a one off job or migration that didn't do the right thing" vibes.

For instance, they could have tried implementing a "deactivate recovery phone numbers if this dataset from cell providers show the owner changed" that went wrong

please help me to restore my hacked account, my account has been hacked by someone whose ID I don't know: https://www.facebook.com/bayu.syaputra.92102?mibextid=ZbWKwL

Thread about the issue was created a year ago, with periodic spikes of people seeing it, most recently today.

Does Facebook use Apache Thrift internally? That’s the only thing I can think of

Facebook invented thrift and gifted it to Apache

Facebook invented Thrift

Facebook was where Thrift originated.

Lots of internal tools used it when I was there, but that was years ago. https://github.com/facebook/fbthrift

Yeah, Thrift as RPC framework. Most DB junk happens in the big pile of Hack+PHP that is the Facebook app, or at least it did in 2020, but apparently someone wrote a Thrift endpoint to munge the database from remote services too.

for those wondering wtf this is, it sounds like something got used as a relay to do some account takeovers at FB.

Possibly, or it might be a bug. See:

https://stackoverflow.com/questions/69881980/accessing-faceb...

Used maliciously or some legitimate code ran at Facebook that was buggy?

083875789184

Reply on news.ycombinator.com