Slashdot Mirror
Researchers Build Malicious Facebook App
narramissic writes "Back in January, a team of researchers uploaded a malicious program to Facebook to demonstrate the possible dangers of social networking applications. Called 'Photo of the Day,' the app serves up a new National Geographic photo daily, but every time it's clicked it sends a 600 K-byte HTTP request for images to a victim's Web site. Photo of the Day is still listed on Facebook, with its authorship attributed to Andreas Makridakis, one of the researchers. The application has 514 active users now, with several comments praising it. The study was published by the Foundation for Research and Technology in Heraklion, Greece, and the Institute for Infocomm Research in Singapore."
Attack!!
'a';DROP TABLE users; SELECT * FROM DATA WHERE name LIKE '%'... if you're reading this, it didn't work.
http://www.itworld.com/print/54718
Duh.
Facebook applications are a nightmare, in my mind.
Is there anything we cannot do?
"Here, grab your ankles, this won't hurt a little bit"
(That is a 100% truthful statement)
I'm a minority race. Save your vitriol for white people.
First of all, let's get something straight. Social networking is a BAD idea. Especially the sort of social networking that takes place at bars, clubs, parties, etc. The only safe place in the world is safe and sound all by your lonesome in your parents' basement.
McCain/Palin '08. Now THAT's hope and change!
So, some researchers used Facebook as a singularly inefficient method of DDoSing someone. Anyone who wants a site taken down will use a botnet or something more reliable (and high-volume) than counting on Facebook users to add the latest greatest app of the day. Am I missing something, or is this really not nearly serious enough even to make /.?
Those who anthropomorphize science and/or nature already believe in an intelligent designer.
There are inherent security risks any time you allow code to be executed on a mammoth scale without some serious security inspection and review.
In your FACE, Google!
Parent is correct. This is a PEBKAC problem if I ever saw one. Man, people really will freak out over every little thing, won't they?
Linux, you magnificent bastard, I read the fucking manual!
tm
Support TBI Research: http://www.raisinhope.org
Why not build a more aggressive app and call it something like "Facebook Botnet Webapp Client 2.04.2" and then reward people minion points for delivered spam, DDoS attack packets, and friend referrals. No need to hide it as a beneficial application, people want to belong to something--why else are they on facebook?
greed@All_Evils:~#
I used to serve a 2mb file of zeros at favicon.ico. I even used a bogus MIME type to give MSIE a fighting chance. Of course MSIE ignored the MIME type and charged ahead anyway.
Isn't there in the EULA/TOS something that makes this verbotten? Unless he's/they've signed an NDA giving fb the time/opportunity to expunge the app, clean up the mess, and warn users, he's just helping the bad guys know fb is inattentive. Not as if the end users all have tools to ferret out the malicious apps.
If he's brought to court, then maybe the terms of settlement could be he acts as fb's and others' human sacrificial firewall.
fb could even retaliate by making a profile of the listed developer, making a negative bio/pic of him, and cause him grief. Not that i'd suggest it, but you never know...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
...all your Facebook are belong to us.
So who was surprised by this? I had the same ideas awhile back when I first joined and noticed my ability to create my own apps. I considered creating one purely for the purpose of collecting user information. Just for the hell of it. But more of a way of seeing just how much data I could gather. I have yet to see an app on facebook that didn't require that you provide access to EVERYTHING. If you check (or uncheck.. don't remember how that works) any of the privacy options you get the message "But we neeeeeeed that!!!"
And it's for that reason I generally don't use any apps on there...
yvan eht nioj
Using the app to DDOS someone is simply the payload. The point is that:
(a) A trojan was introduced into the ecosystem.
(b) Users installed it.
It's not clear whether the users simply saw it in the directory and installed it, or whether they looked at their friends' apps and said, "Hey, that looks interesting." (Or whether users were promoting it to their friends, like a chain letter.)
The lesson is that social network apps need to be treated with the same caution as apps that you would install on your computer.
Facebook is still operational.
They built a malicious face book application. Big deal. They're all malicious and annoying. The whole damn site is a marketing work to pull personal data about interconnected relationships together for marketing.
"Malicious Facebook App" is like "Table Mesa" (a place in Arizona). Its redundant Mesa means Table in Spanish.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
I guess I don't get it... You click on a link for a picture, and it sends a request for a picture? Is this like me posting a link to picture here on /. that resides on a "victims" server?
Personally, I consider Facebook to be a malicious app.
The higher the technology, the sharper that two-edged sword.
This seems, when all is said and done, to simply be taking advantage of the power of large numbers of people on the Internet. Facebook is merely a userbase that happens to have a toolset attached. Admittedly, the userbase is somewhat more suggestible than many others (see the various superhero/pirate/ninja viral games that can be seen cavorting across people's profiles); however, this type of coordination has been done before, albeit usually with participants' knowledge.
Hopefully, we can see this amount of effort on the part of researchers directed toward positive applications. Existing examples include the Search for Extraterrestrial Intelligence (SETI), protein folding, and the Mechanical Turk project.
This isn't so much a security issue as an underexploited resource. That said, the API hardly needs to leave its doors open to this sort of thing.
Oh FCOL, who the fuck moderated this as troll - c'mon - play nicely here - over the last few days it seems that a metric fuckton of non-troll and/or non-flamebait posts have been modded most unfairly. Who the hell is getting modpoints these days?
Mod Parent down
-1 Censored.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
their 'army' is about 500 requests a minute.
LAME!!!!!
Heh. Researchers experiment with anything malicious they want in the name of research and publish their findings widely for the bad guys to consume.
Looks like you're a black hat, and you're annoyed that more young people are truly computer literate, and more useful information is available to non-expert but careful users.
With the tenuous justification "the bad guys would have surely come up with this already"
The purpose of research is knowledge. As a researcher, I'm not responsible to provide justification of what somebody else does with knowledge I discover, nor to provide further justification of my discovery of it due to that other person's choice to make criminal use of the knowledge I discovered. The criminal is solely responsible for the criminal act.
Plus not that many bad guys will think of X attack; at least not until there are news articles or a fad, other well-known bad apps to mimick.
Oh, yeah right!! No scumbag would ever have come up with such a diabolical plan of attack, as dump a malicious app on a site for casual computers to trade pictures, shortly after said site introduces app sharing to its crappy services. You are ridiculous.
The "researchers" are helping, providing inspiration, and guidance to would-be part-time bad guys.
Stuff that back where you pulled it from.
Sorry, but it was pretty obvious to people familiar with Facebook apps and computer security, that this weakness existed.
And to crackers. It was not obvious to the users, but now it is.
Nothing novel or valuable has really been found here
Both those qualities are in the eye of the beholder.
... except things that should have been reported to the site admins to be fixed.
Why? Will they share their profits, for such a service? For providing a fig leaf to help them cover their lack of vigilance, or how plainly stupid their idea was: "encourage casual users to share programs without any screening process"? Either the admins are competent and responsible enough to find and secure their site themselves, or else they're incompetent enough and irresponsible enough to deserve a public humiliation of the sort they are now receiving. They got what they deserved for trying to get rich on a networking-to-attract-advertising-revenue Ponzi scheme. You misidentify the social problem at the root of the symptom that is the general topic of this thread. That symptom is the insecurity of the biggest names in computing: Microsoft, US government, now Facebook. The root cause is the rewarding of sub-standard work. It has caused one dot-com bust already. I, for one, am in no mood for another. If projects of this scale were as a rule successfully deployed on the first public release, with all advertised features, and secure, I'd say programmers are by and large worthy of their 6-figure salaries. As it is, I say the average IT guy's salary is 85% hyperbole. Just because programmers are rare, the law of supply and demand dictates that even crappy ones have to be paid hand over fist. Such would change, if only secure apps and services were demanded by the consumer market. The more effectively crappy, insecure apps and services can be identified, the more efficiently the invisible hand can operate.
The researchers did valuable work, but it's clear that the worldwide security threat of releasing the information to third parties is greater.
The opposite is clear. One valuable service these researchers provided -- the most valuable, I think -- is they showed a lot of Facebook users that their host is not capable of securely providing at least the app sharing services it offers: they showed its victims that Facebook is not trustworthy. Many of the users do not have the technical backgro
All 19 hijackers were known terrorists 09-10-2001. Lack of FBI intelligence does not justify warrantless wiretaps..
That position is irresponsible in that it entails the researcher simply ignoring the very effects positive and negative that society will have to endure based on their publication. Governments and society as a whole have already seemingly taken a position counter to that [guardian.co.uk], [2] [slashdot.org], and the result will probably be eventual formal government regulation to better keep dangerous information quiet.
Your second source is an article about events centered on a high school, where students' rights are limited by the legal doctrine in loco parentis. (sp?) So that also is not an example of how society normally functions.
For example, there is classified information. If a researcher attempts to publish usable do-it-yourself details for making a nuclear bomb, they may well find themselves locked up.
Discovery Channel showed a history of the A-bomb a few years ago, which I thought was as good as the best consumer user's manual I've ever had the good fortune of getting bundled with purchase. The tricky step is purifying the radioactive material to weapons grade. After that, assembly is nothing. As a result, teaching particle physics in universities is permitted. What is not permitted is the act of producing weapons grade nuclear material. The good or evil is in an action, not in the knowledge.
Just because the laws haven't caught up yet to prevent computer security researchers from irresponsibly publishing dangerous information for all to get the most intricate details including ready-to-run attacks, does not mean that it is responsible or good for researchers to do so.
Facebook dangerously published all the information for all the Black Hats to get the most intricate details, etc., etc. The researchers made that information available to Facebook's customers. Bravo to them!
All 19 hijackers were known terrorists 09-10-2001. Lack of FBI intelligence does not justify warrantless wiretaps..
Their staffing and other financial records are available for inspection;
As a former customer, I'd have more appreciation for the opportunity to inspect their source code.
lookup their annual reports to see massive spending & staffing in research; there can be no doubts there.
The SEC exists because unsuccessful corporations have been known to lie, and caught at it. Only a fool has "no doubts" about corporate self-reporting.
I base this on the existence of Fortune-100 companies whose reason for existence is to deliver security solutions, and have multi-billion$ security budgets to that effect.
Symantec, is "only" #461, and (AFAIK) it's the largest corp. whose primary product is computer security. This is not nit-picking; your entire argument is based on scale, and the largest of the companies of the type you're discussing, is barely in the Fortune 500, not the 100.
Speaking of which, have Symantec and McAfee made the Internet safe yet? No. How many more billions of dollars do they want before providing the "security" they've been advertising for over a decade, anyway? Looks exactly like a protection racket to me.
Keeping consumer product information freely available is always better for the customer. In the specific case of computer security, publishing information about the relative strengths of competing products' access controls allows people to learn better how to "roll our own" solutions, or if we buy corporate security products, more information allows us to choose better purchases. For everybody, and therefore for society as a whole, more available information is better. Deciding what information we want and need, and learning where to get it, is the individual's responsibility. This is existential fact, which means it will not be altered by your acknowledgment, nor by your refusal to acknowledge truth. Agree, or let me decide what information to not allow you to have, about whatever consumer product category I choose.
The protection of the First Amendment is not limited to speech that you approve.
All 19 hijackers were known terrorists 09-10-2001. Lack of FBI intelligence does not justify warrantless wiretaps..