Slashdot Mirror
Facebook Employees' Laptops Compromised; User Data Believed Safe
Trailrunner7 writes "Laptops belonging to several Facebook employees were compromised recently and infected with malware that the company said was installed through the use of a Java zero-day exploit that bypassed the software's sandbox. Facebook claims that no user data was affected by the attack and says that it has been working with law enforcement to investigate the attack, which also affected other unnamed companies. Facebook officials did not identify the specific kind of malware that the attackers installed on the compromised laptops, but said that the employee's machines were infected when they visited a mobile developer Web site that was hosting the Java exploit. When the employees visited the site, the exploit attacked a zero-day vulnerability in Java that was able to bypass the software's sandbox and enable the attackers to install malware. The company said it reported the vulnerability to Oracle, which then patched the Java bug on Feb. 1."
you use windows as your dev environment
but who's gonna protect people's data from Facebook itself?
Given Facebook's MO, users should assume that anything Facebook, Inc. had access to is already in the hands of people you can't trust.
Them being hacked is pretty irrelevant.
Facebook's users finally have privacy because someone got in and hacked into Facebook's laptops? What did they do, disable the graph API?
You are not alone. This is not normal. None of this is normal.
Well, that's good to know. I'd hate to think of all those sensitive personal data falling into the hands of some evil corporation that would exploit it to make money with no concern for the privacy of the people involved.
I don't see why it would be so difficult to keep user data safe. Keep it encrypted, use a VPN, stream the data to memory but never store any of it unencrypted.
What's the point of these articles that announce that so and so company's systems have been hacked? They never contain any forensic information about the exploits other than to loosely identify the vulnerable software the bad guys used to get into the system. No identification of the malware installed, no identification of the OS's the laptop were running, no identification of any antivirus products that turned out to be completely useless in stopping the attacks. IOW, no goddamn information that would be useful to anyone who wanted protect themselves from attack, or at least detect whether their system were already compromised.
The lack of forensic details about the attack provided by Facebook or any of the other companies hit with the java exploit causes great doubt about their claims that no user data was accessed.
A man gave way to a car and no accident happened.
Are we in such a bad shape that NOT compromising personal data has become the news worthy factor?
Don't fight for your country, if your country does not fight for you.
Can we all stop saying zero day? it's just an attempt to sound cool and hackish and it means nothing. it's a vulnerability, and it has an exploit and no patch is available, as opposed to unpatched.
if they release new software that they brag is secure, and you have an exploit that already compromises a vuln, ok, you have a zero day because that's day one of something. then it makes sense. otherwise, it's false street cred and bravado.
Ok, Java is hosed, most of Adobe is hosed etc...
But has anybody ever considered the dangers of embedded linux devices in a company? Some of these things are pretty powerful with the right ARM socket, shady firmware and make the perfect backdoor in whatever corporate infrastructure. It's not that everybody is equipped with the latest firewall, the latest IDS or latest Layer 7 proxy or DPI on SSL and even then, DPI on SSL or Layer7 proxies can be performance hogs in a time that end users want to have a webpage loaded in 0.0000001 seconds. /conspiracy-theory: Make some overhyped BIG Ltd with cheap embedded solutions, send demo units to the whole world and your backdoor/botnet is in place. Don't put a real backdoor in it, just make it 'vulnerable' and if someone would find an exploit, patch it, like the good guys, and introduce another one.
Turns out Facebook employees don't know what the fuck they're doing. Keep drinking the beer, at least that'll give you good memories later in life.
A photo of the hacker planting the malware can be found here.
http://arstechnica.com/security/2013/02/at-facebook-zero-day-exploits-backdoor-code-bring-war-games-drill-to-life/
"The FBI e-mail, zero-day exploit, and backdoor code, it turns out, were part of an elaborate drill Facebook executives devised to test the company's defenses and incident responders. The goal: to create a realistic security disaster to see how well employees fared at unraveling and repelling it. While the attack was simulated, it contained as many real elements as possible."
Your data was spread across the 4 winds as soon as you started using Facebook.
The only "problem" here is that your data has now been around the globe without Facebook getting to monetize the transaction.
I think that's the first time that the phrases "user data believed safe" and "Facebook" have been uttered in the same sentence.