Hacker News Reader

Comment by debt | Hacker News Reader

That's a pretty amateur mistake for a such an enormous company. Made respect for FB, but c'mon, how'd this slip through? This was a very trivial exploit.

View on HN

I don't really agree. They made all the effort to put CSRF tokens everywhere, and the vast majority are properly validated, but here there was probably some bug where they assumed the CSRF token validation check was always running, but I guess it wasn't.

It's certainly a mistake, but it was probably easy for developers and QA to miss.

I disagree with that. It's a get request that is changing state server-side. That is a dead giveaway for a CSRF vulnerability.

They didn't validate the token nor did they make sure the user id was valid for the request; that's two important checks that either weren't there or failed. Seems like they just weren't there as there would have been more failures like this throughout the site. Because those checks weren't there I'd say it was an amateur mistake. Again, if this is the case then the engineer just made an assumption that this request can only be made in particular user state.

Nearly every exploit is a "pretty amateur mistake" in hindsight.

Not really, no.

Would you give some examples of some exploits which you feel weren't exploiting amateur mistakes?

http://www.exploit-db.com/exploits/28974/

Here's one. A use-after-free triggered due to some faulty logic.

Mistake? Yes. Amateur mistake? No. Even very experienced C/C++ programmers, such as Microsoft's top devs, may accidentally double-free, or use already-free memory.

Don't static analyzers catch a lot of these bugs these days? (if one can be bothered to configure and use them)

And wade through a forest of false positives.

They do. And I imagine Microsoft employs static analyzers very frequently.

They can't always catch everything, though.

Almost every exploit in the wild seems trivial. The hard part is ensuring you don't ever miss one.

you are right, facebook had lots of CSRF previously, it is obvious they don't take basic security seriously

it is obvious they don't take basic security seriously

I would disagree.

For a very actively developed web site, it takes very good focus to not trip up. Having a bounty program is an indication to me that they take security seriously. Fixing a security bug in a matter of hours indicates to me that they take security seriously.

Amount and stupidness of bugs in fb says otherwise

Reply on news.ycombinator.com