At Facebook, zero-day exploits, backdoor code bring war games drill to life

Yeah, the moment we realized what was going on, it was like one of those horror stories you tell as a kid: "...the call was coming from INSIDE THE HOUSE."

The only way an attacker could have come across this URL would be if they had access to our codebase specifically - the string in the "extra_log" param was hardcoded in the PHP endpoint. It didn't even occur to me that they might have placed it there. Only when someone pointed out that this param was actually md5("october") did we start to wonder if it might be a drill.

(I work at Facebook but don't know anything about the event in question or if this post is accurate)

I suspect it wasn't actually a "0-day" in that sense, but rather a disclosed but unpatched vulnerability, and described as "a real 0-day exploit" in the article because of the typical reduced fidelity of press articles.

Exactly how hard do you think it is to get your hands on an exploit for an unpatched vulnerability?

How did they get their hands on an 0day? Probably found it. It isn't like you have to buy plutonium from some Libyan nationalists -- Facebook has plenty of smart engineers who can audit the software they use.

I've seen 0days found by engineers at other tech companies, so I find it likely that somebody at Facebook could run across one if they tried.

I'm trying really hard not to read your post in Ned Flanders' voice.

But in terms of 0-day exploits, I believe there is a ready market for them if you know where to look, and are willing to pay.

Trustwave was the outside party running the penetration test. 0-days are commonly used by pentesters, and are available for purchase by subscription as well as one offs that are made available via mailing lists etc.

For example: https://www.immunityinc.com/canvas-cep.shtml

This is standard practice for the industry and quite common. But do note that not all 0-days are created equal: a 0-day that effects 1000 users is 1000x the significance of one that effects only one user (with some notable exceptions). Also realize that 0-day is often used misleadingly - anything that was first used in the wild is a 0-day, even if that event was months ago, the vendor has been informed, and crucially - even if a patch has been issued by the vendor. Pentest firms often oversell their "0-days" in an effort to appear more advanced to their clients.

These teams usually work in rotations, so if you have prior knowledge of a personal event then you'd take yourself out of the rotation for that time period.

The article says that in an earlier test, "the organizers made an exception, however, when early in the drill, an employee said the magnitude of the intrusion he was investigating would require him to cancel a vacation that was scheduled to begin the following week. McGeehan pulled the employee aside and explained it was only a drill and then instructed him to keep that information private." I'd hazard a guess that they wouldn't keep you there if you had something important going on, but I can see the issue if it becomes a regular occurrence. Employees would be complacent and potentially always play the "vacation" card at some point to test to see if it was real or not.

I was one of the people involved here (the guy quoted as saying "which means that whoever discovered this is looking at our code").

As the article noted, they started the whole drill relatively early in the morning on a workday (a Wednesday, iirc, which are the days where we do not have meetings). About half an hour after we'd fixed the obvious problem and were starting to dig deeper, the guys organizing the whole thing stepped in and let us know it was actually a drill, but that we were going to keep treating it as if it were real.

It actually ended up being a super interesting and eye-opening experience, and drove good changes to some of our infrastructure. I had no idea we'd go so far as buying a 0-day and using it to test our own systems and response, but I think it shows that we don't screw around when it comes to making sure we're secure.

It appears the term possibly came about after the DoD was attacked by malware in early 2008. This magazine, from literally a day before that Businessweek article, refers to the DoD as the source: http://books.google.com/books?id=bmAEAAAAMBAJ&lpg=PA13&#...

Very good idea, but that'd test threat detection, not threat response. Different teams handle those areas.

Your imagination seems a little lacking if you think that the only outcome of such an attack on Facebook was the disclosure of personal information.

That's more about natural disasters, like losing a network node to a meteor.

The Facebook story is about response to attack.

Client side zero-day is not even remotely unrealistic for an organization like Facebook. This stuff happens much more than you think it does.

What makes you think this is the only security drill Facebook has performed?

While FB may not be a nuclear facility, I can pretty much guarantee you that people who use nuclear facilities (or their equivalent) have FB accounts. And that hacking those accounts and/or the computers that are used to access them would probably be a not good thing.

Facebook has on the order of a billion users. That's a huge cache of interesting content and access no matter how you slice it.

Facebook is probably more of a target than Iran's nuclear facilities. Having an omniscient view of Facebook's users would be extraordinarily valuable to anyone in power, not to mention the ability to spearfish.

The vast majority of these sorts of exploits are delivered via spearfishing, which is a form of social exploit in that a human being is fooled into clicking a link or opening a file that contains malicious code. The article doesn't specify, but I would bet that was the vector in this case too.

Also, Anonymous is far from the most sophisticated attacks a company like Facebook will see. They tend to stick to DDOS and easy SQL injections.

Well, google possibly, but, yeah, FB being deemed "critical" is a bit of a mystery to me. I can more accept twitter being "critical".

I would have thought infrastructure is properly "critical", various websites not so.

Without drills, how would you suggest Facebook tests the response times and standards of their security teams? If you want to know how the team will react under pressure, you essentially have two options:

- make up a fake security alert

- wait until a real attack is underway

Perhaps I'm missing something, but I do not see a connection to Office Space.