Slashdot Mirror
Facebook Rolled Its Own 0Day For Red Team Exercise
chicksdaddy writes "Threatpost has the story of the extreme — even hair-raising — lengths that Facebook's incident response team has gone to in order to prepare the company's staff to be hacked. Among the methods described at the CanSecWest Conference: 'Operation Loopback' in 2012, which was designed to mimic an APT-style attack from China and used what appears to be an internally developed exploit for an internally discovered 0day. From the article: 'McGeehan and his team this time identified a likely attacker — China — and decided to impersonate its tactics. For this one, they recruited an internal engineer as an accomplice. They wanted to get a backdoor into Facebook's production code, so they sent a spear-phishing email containing exploit code for a live zero-day vulnerability to the engineer. He dutifully clicked the link and his machine was promptly compromised. (McGeehan would not identify which product the vulnerability affected, nor how the Facebook team came into possession of it, but said that they disclosed it to the affected vendor before the Loopback exercise and used it before the patch was publicly available.)' Ouch!"
For falling for their elaborate socially engineered social engineering in the guise of testing their system.
I mean, with the soviets gone, Sadam gone, Bin Laden gone, SOMEONE has to step up to be the stereotype arch-enemy of the US. So let's build this image because hey, we just have to learn and be prejudiced with 1 and a half billion people. After all, what good are the chinese for? We don't need them right?
More companies should do that kind of testing. If only they would spend that much effort on building a reliable user interface...
Correct me if I'm wrong but it's not really a zero day 'sploit if it's internally known, the attack is internal penetration testing, and the exploit gets closed before it's known.
\
Lame ass attempt at hacking prevention
we know they have succeeded when the headline is "Zuckerberg double down and loses!"
This is all bullshit.
On Feb 10th, ArsTechnia released the following story: http://arstechnica.com/security/2013/02/at-facebook-zero-day-exploits-backdoor-code-bring-war-games-drill-to-life/
On Feb 19th, The Register released this: http://www.theregister.co.uk/2013/02/19/apple_hacked/
On Feb 20th, CNN released this: http://www.cnn.com/2013/02/20/tech/web/hacked-apple-facebook-twitter
On the 10th I said they got pwned for real in #misec on freenode, and 9 days later I was proven right. This is nothing more than a publically traded company trying to save face.... or something. But the "wargame" and actual hacking are NOT coincidences.
- ShadowHatesYou
In 1972 an APT commando unit was sent to facebook by an internal engineer for a crime they didn't commit. These men promptly wrote a spear-phising e-mail from a maximum security stockade to the China underground. Today, still wanted by the government, they survive as soldiers of fortune. If you have a zero-day exploit, if no one else can help, and if you can find them, maybe you can hire the APT-Team.
Seriously?
When the extortion email arrived, the members of the response team began checking their bank accounts and personal webmail accounts to see whether they had been compromised, as well.
So that's a joke. The fact that they had an accomplice click their "spear phish" intentionally is also a joke, as you can just start with a remote attack platform locally and call it the same. Where were their engagement rules? Oh, there were none? Yeah, let's fuck off on our prod environment playing APT!
"We got onto the developer's system and then put a change into his PHP code and pushed it live," McGeehan said. "That affects a billion users, but the backdoor was designed not to run."
Irresponsible idiots.
Aren't they supposed to be trying to mobilise their systems so they can knock Google in to irrelevance to gratify their stockholders delusions?
No wait, that's never gonna happen. Might as well fish out some crappy POC from SecurityFocus code it up and and see if their dumb ass hipster engineers will accidentally click on it while thinking it was supposed to be a link to a cute kitty pix. I reckon for their next trick they should start filming their own version of Jackass in the HQ office ... Mark Zuckkerballs taking a blowtorch to his scrotum, who wouldn't pay to see that?
FaceBook doesn't really need to do this, their are dozens of security firms out there that can show them how to hold a secure infrastructure. This seems like just a total waste of time for some reason as to pretend to be a "l33t hax0r" or something. I can't figure what's the method to the madness here ....
That you speak of?
In the world where, despite their different core competencies in terms of engineering ways to attract non-paying users to whom their customers can advertise, both of them actually make the vast majority of their revenue selling online advertising.
Google+ isn't where Google competes with Facebook directly for money. Social network users aren't either company's paying customers.