Slashdot Mirror
Huge Vulnerabilities In Facebook Chat and Messenger Exploitable With Basic HTML (helpnetsecurity.com)
An anonymous reader writes: Check Point's security research team has discovered vulnerabilities in Facebook's standard online Chat function, as well as Messenger app. The vulnerabilities, if exploited, would allow anyone to essentially take control of any message sent by Chat or Messenger, modify its contents, distribute malware and even insert automation techniques to outsmart security defences. To exploit the vulnerability, an attacker simply needed to identify the unique ID for the sent message he or she is targeting.According to the report, Facebook, in conjunction with Check Point's researchers, patched the vulnerability earlier this month.
Here I was using Facebook chat for all my super secret communications.
You would think that the element was no longer a security threat.
There have been huge vulnerabilities in beta that could compromise the accounts of actual users. They don't really seem to care about the security of their users, only about collecting as much data as possible for advertisers. Are there any legitimate reasons for anyone to use Facebook any longer? I think not. I've been modded down to -1 for asking this question before and it's a chickenshit way to avoid the question. Facebook doesn't seem to care about security and the only way to change that is to stop giving them fodder for ad revenue.
Shuddapp.
How do you identify the unique ID of the message? If the message is sent to you (or a group including you), I guess that works. How else?
If message unique IDs are cryptographically secure--if they're 128-bit random GUIDs from a strong entropy source--then this is like saying an attacker only needs the unique private key to hijack Verisign. If they're akin to the ObjectID in MongoDB--datestamp, machine, process, and 24-bit random counter--then we can go fishing. If the ID is discoverable only by being the logged-in user, then you need a browser-end hijack or a TLS-breaking MITM, in which case there are any number of ways to invisibly send messages and not send messages the user types.
Support my political activism on Patreon.
Choppa four reporting - huge chemical fire downtown this morning, smoke can be seen for miles, massive flames and explosions In other news, local firefighters and teams from surrounding counties put out the fire last week....
It has been seen many times that big websites have huge holes in their security. I believe they can fix everything as there are millions of users who use facebook everyday.
Here's the deal. Nobody cares about discovering if Susie fed her cat and told Tammy or not. This is just a false sense of security story again. If you put your info on Facebook, it is immediately able to be scanned and cross-referenced ad nauseum by the government.
Facebook and Twitter profile, Google tracks.
Seen Eric Schmidt CEO of Google lately? http://bilderbergmeetings.org/participants.html
All of the mass immigration issues and deciding if a Jew, an old lady body double, or an actor/businessman is going to run the US Military is a sham.
*cough**cough*
If you only give half a shit about your privacy and you're using anything that as much as touches Facebook, you're doing it wrong.
With exploit, without exploit, the difference matters only to Facebook, i.e. whether they have to share your private data with someone else. To you, the difference is negligible.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
And Facebook wants to use the messenger app to send payments? If they have this much trouble with basic security over social chatting, why should we trust them to handle payment processing? If you can't do the simple things right, you certainly can't be expected to successfully accomplish the difficult things.
This is what you get when you hire a bunch of developers doing straight RESTful interfaces on top of MongoDB having no idea what they are actually doing. I am amazed at the lack of security I see in most of the software developed these days, and while RESTful can be a great approach, people also need to realize how open and easy to abuse it really is.
It really is funny how all of these things we solved ages ago are having to be redone because now we have a new platform that doesn't just give you all of this built in. Hopefully the node level javascript developers can be taught the importance of actual security and designing an enterprise/internet level system and what that means, but with trends like 'microservices' being the rage, I somehow doubt that.
This is the difference between being a programmer, and being an engineer.
Rant off....
HTTP requests are not HTML code.
Scopes is the word. Only scopes can give scopers the scope to scope scopy scopes. Scopes will do away with LUDDITE apps.
Scopes!
EVERY HTML app I've ever used sucked royally.
Delays, dropped letters, crashes.
Barely one step above two tin cans and some string.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
This is why the moment I got my new phone I started disabling things. This is why the moment I saw that half the apps on my phone wanted permission to use the camera and microphone, all but 4 of them got denied that going forward.
I garauntee you facebook apps have these permissions and don't need them. The camera app takes photos, camera access is not even needed to access already stored photos....its off.
"I opened my eyes, and everything went dark again"
I can hardly believe this- I mean, Facebook has always had such a spotless record when it comes to security!
Just cruising through this digital world at 33 1/3 rpm...
#stillboring