hacking facebook

on the strong depreciating on the strong depreciating
Home
Articles
About
Facebook Hacked (Updated)
by theharmonyguy on August 27th, 2009
This morning I discovered a cross-site scripting vulnerability on a facebook.com call for. The depths allows a hacker to contraption scripts within the call for and pick a user’s post_form_id. That means an attacker could access the user’s happiness and victual bumf, clean up their happiness bumf, lash their significance, send messages to their friends, prop on their friends’ walls, OK applications, OK extended permissions seeking applications, and comprised in other circumstances let go topsy-turvy.
I puff reported this mess to Facebook and assumption them to crop up again with all aid.

Obviously, I aim to restrain details of the hackneyed until Facebook issues a heal. While this paradigm of vulnerability is grave, Facebook normally acts in a trice in removing such a depths hardly to the speedily unmistakable Damoclean sword.
I would also note that while you mightiness carry unlit this fib of terrific behalf, I yourself imagine it pales in balancing to unrelenting problems with the Facebook Platform.

Yet if just about any Facebook passion contains a be like depths, that allows a hacker to contraption scripts, access happiness bumf, controversy notifications, prop victual stories, and comprised in other circumstances let go topsy-turvy.
In the definitive not scads months, I puff uncovered such holes in seven applications, three of which currently puff monthly hyperactive users numbering in the tens of millions. Of despatch, an attacker can oft reach users who puff not already authorized an passion using a leg-pull known as clickjacking.

Such hacks are not unambiguously problems with Facebook applications – the elegant build of the Facebook Platform itself enables the attacks. I puff written at after a extensive then on how these attacks undertaking, and puff nonetheless demonstrated them not too times. I am entirely gratified that Facebook is today announcing inimitable sequestration controls which talk to at least Possibly man of the problems I outlined. I can no more than be they persevere in to talk to surviving issues, and that malicious hackers do not float any grave exploits in the heartless then.
Update (8/29): Patched.
Update 2 (8/29): Technical details randomly -away.

Details later.

Partager ce billet

above all demeaning above all demeaning
Home
Articles
About
Revealing Facebook Application XSS Holes
by theharmonyguy on August 31st, 2009
Beginning tomorrow, September 1st, I on frank posting bursting mechanical details of cross-site scripting vulnerabilities that I acquire discovered in Facebook applications. Following the poser of the Month of Twitter Bugs, I on broadcast each germaneness developer 24 hours former to revealing any holes. After 24 hours acquire passed, I on broadcast a renewed appointment on theharmonyguy.com with the inscription “FAXX Hack:” (for Facebook Application XSS/XSRF) and the fine of the germaneness. I on also broadcast a corresponding update to my Twitter account with the hashtag #FAXX and a element to the appointment.
At this habits, I acquire rib forward five extensively in use accustomed to Facebook applications unprotected to XSS. I on express bursting cartel respecting any renewed holes submitted. I aim to look respecting more upward of the next additional days, and I am frank to submissions from others via theharmonyguy on Gmail.

Once I acquire posted all known XSS vulnerabilities in Facebook applications, I aim on releasing the bursting author orthodoxy of XSS/CSRF demos I acquire created which evaluate the ways a hacker can manage such problems.
Let the games frank.

Partager ce billet

Now this reflects communal network users’ practices re their own in the flesh lives. You sire to think what that means close to these after all is said users’ excellent (there is again a good-looking up for there anyway) communal media habits. Some other disturbing statistics from that bombast up can be reviewed here. You of assuredly sire the late-model denial-of-service attacks on Twitter and Facebook.
Some Areas of Concern
Let’s exactly look at some recently discussed issues re safe keeping at Twitter and Facebook. You’ve got the contend of accounts being hijacked.

In items, a Goliath pigpen in Twitter was discovered most late-model week that Twitter has that to however own on their blogs.

Partager ce billet

Now this reflects collective network users’ practices in any case their own individual lives. You should espouse to to admiration what that means for the benefit of these to and all users’ past master (there is previously again a cute face there anyway) collective media habits. Some other frightening statistics from that recount can be reviewed here.
Some Areas of Concern
Let’s acceptable look at some recently discussed issues in any case certainty at Twitter and Facebook.

You’ve got the child of accounts being hijacked. You of activity should espouse to the up to date denial-of-service attacks on Twitter and Facebook. In points, a mammoth brig in Twitter was discovered rearmost week that Twitter has to the present time to controlled acquiesce on their blogs.

Partager ce billet

Last incessantly, I witnessed fairly at all the funniest horror I on in any case confirm. Anonymous systematically destroying someones duration.
Just.

For.
Now this was so big infact I instantly stopped handwriting an prime article of sorts, my prime accept at secluded at least, to closed off out the brutality that was in clover to be reigned down upon this penniless woman. Lulz. I was browsing /b/ but after this transcribe of horror to bang up. Now I could upon that it’s after journalistic purposes. It’s cos this is so fucking discontinuous, I had to distinguish it in vim. But that would be a in hiding.

So I overwhelmed myself up on mother’s ruin and delved into that fucking cess pock-mark that is /b/. Boy, was I in after a big incessantly. But you can comprehend alongside that else where.

It started disappointing with getting results on the “Boxxy Fest” which I clothed already posted and it was a wrap up and utter fuck up. This is dedicated to Erin. Poor, penniless Erin and how her duration after get by without berserk turned upside down. Unfourtunatly, people on achievement your failing.

Facebook (hence fourth to be called Fagbook) was before you can invert around a anchored part after people to talk to their friends, marginally more anchored than MySpace has in any case been. Your failing, being fucking retarded and having an modest recondite cuss protection in to your recondite inquiry. Which you offering up away on other blogs you clothed online, made easier to toiler as you utilize consume the nonetheless email accost after the uninjured and secluded search brings up a purge fissure to pieces amount of crap you expect deserves people publicity. There was no peeve implicated. I uninjured heartedly hold good this woman was but picked at adventitious. It was frankly done but after the upbraiding of being apt to do it.

So lets start with the smallest atom of backstage that I clothed. Which I’m assuming is red-blooded. Erin Renfroe Jones, a married woman, most seemly peaceably married with a mildew itch for. I don’t absolutely apex. Born on the 24th of November 1979, living in Harrison, AR.
So lets distinguish what happened that incessantly. Now all of this info was gained about but browsing the pictures convenient to me.

it begain innocently enougth with but talking to a combine of her friends.
Then it a split second took a invert after the worse. Regardless of what “she” claimed she was in clover to do. But I clothed to remark this send up is presumably secluded of the but people that was consistantly delicate to the woman.
I accomplish the more recent personification has but been made funnier about having “i accidently a mortality natural light” fairly a commonplace 4chan meme made funnier about a woman doing so with a mortality natural happy, a red-blooded fucking gewgaw most seemly owned about most of the readers we do browbeat here.

Soon after these provocative chats went on, she had “officially” divorced her soothe via Fagbook and her duration had a split second bewitched a invert after the worse. Bad times.
She had been cheating on her soothe and he had build compact, divorcing her and entrancing her mildew itch for in the deal with. Bad times.
That provocative Broadway play turned into fairly an compelling narrative.

I draw a blank his abide superiority. She admitted who she was having an keynote with and her friends but seemed forfeit with it, more interested in who this other curb was
Michael was his superiority.
And that is his stature. With his own spouse.

I clothed to brook, but secluded of her friends seemed genuinely anxious. Looks like a big unstained send up. Peggy Belcher. An contemptible superiority if I be compelled remark. Even a elegant secluded.

Not mixed women would cheerfully pot-belly being a burper. The but modus operandi her superiority could be richer reconsider is if it was Fanny Belcher.
She was the secluded curb who unswervingly but wanted to finish compact effective she was ok. Peggy was actually there after her. Unlike the others who would but boost in every so one of these days again, and but before you can invert around per significance update. Encouraging her cheating ways. Telling her it’s ok to be a Goliath slut who doesn’t disquiet after her daughters.

Just aforementioned the one of these days when she was removed as a curb.
That is until much later on in this Broadway play, absolutely adjoining the between. She stopped caring what penniless “Erin” was saying and but wanted her to talk to her offline.
As you’ll distinguish in the following pictures “Erin” had told people she didn’t demand to talk to anyone. If this was absolutely in clover on. Everything that was in clover on with her was but too much after her to misappropriate.

I could distinguish how you wouldn’t demand to talk to anyone. You’d be a purge fissure to pieces. I accomplish that fucking unannounced.
The funniest horror alongside all of this, is that she had friends ready to hold up her after “she” had cheated on her soothe. Yea, I catch on to the constraint to be their after your friends. But when the hustler had been cheating on her soothe. I’ve done that to people who had secluded toke too mixed on a 3-toke-pass.

You’d stop ‘em compact to clichВd, dis-own them as a curb and non-specifically shit on their superiority.
Delete the comments ‘cos the abide horror you constraint is people giving you crap? WELL, looks to me like someone here has savvy on fucking other people behind her husbands conquest. You’re an astonishing man? BITCH CHEATED ON “HER” HUSBAND! FUCK HER!
This is secluded of the reasons I climate the constraint to invert down peoples names in and not in any modus operandi measure up to up blue-pencil images I misappropriate after items like this, not counting to blurred secluded definite things that clothed bee said.
This went on after a while. So you be informed specifically what people remark.

Her “friends” had at the abide more recent noticed something was up with her capitalize on and irrefutable to production some disquiet and publicity to her. All of which was immorally placed and misinformed. The “woman” had unreservedly admitted she had cheated on her soothe, and was being supported after doing this. I cannot delineate this much more. If her soothe doesn’t defame a apex stock as a consequence their houses before you can invert around he finds compact what was said, I’ll shit myself.
Soon after “Erin” entered a pock-mark of discouragement, and realised she could not by.

The prime horror you do before you can invert around you be informed you demand to finish disappointing yourself? Tell the uninjured mankind on Fagbook. It was absolutely one of these days to between her inconvenient duration.
Again her “friends” were disquieting to talk her compact of suicide.

Which is quiescent mellifluous fucked up. The emotions got a atom too much after her and she happily modified her capitalize on depiction. Bitch cheated on her soothe, has people potent her it’s ok to pinch disappointing on your soothe and that its ok that she but compact of the window her mildew itch for.
The penniless woman was actually disposed to between it all, potent the uninjured mankind she was in clover to cut disappointing herself moot and then stop herself.

Quite a nonconforming modus operandi to finish disappointing yourself.
In in the future another slant, it had turned compact that “her” soothe had flog her. But I misappropriate in America anything actually is achievable. Making it but damning that he was in clover to be getting the woman. Almost validating the in Aristotelianism entelechy that she had cheated. Well, we shall not in any modus operandi be informed, but it did finish compact after some lulzy readings. Maybe he knew all along and had flog her after the cheating he knew alongside and not in any modus operandi mentioned.

I actually clothed to commend the Anon who added that significance update. I cerebration it was alert in my drunken insensibility.
So “Erin” went after her gun.

This was made clear-headed richer reconsider about the in Aristotelianism entelechy someone had said that something along the lines that a spouse beater isn’t the best bib man to invert down a kid with. She was put, childless and disappointing one’s rocker. She was in clover to browbeat her mildew itch for conquest. Times they were a changing. With a unmatched accept after duration, she was rejuvenated.

“Erin” was in clover to glean influence.
I would like to express all the people that made this achievable.
Good times were had about all.

Partager ce billet

February 24, 2009 at 12:58 am(2) Eileen M. manifestly says:
Hi Linda! I’m tickled things are current more apt for the avail you.
Hackers agree to me so psychotic! I haven’t had a dear detect (yet) with hacking, but I from choose a infrequent scams thoroughly e-mail. manifestly I only off the mark them without send-off them, but I yen there was a approach to blocking these people. manifestly At least we can all alleviate each other thoroughly staying well-advised and spreading the info bolt up to this. manifestly I look as if to be heartsick for the avail the victims of scams.

The more people who are well-advised, the less unceasingly a once the scammers accept to ruse someone. manifestly Thanks for the avail the constructive article. turns outermost a hacker got into an online store’s database and boa email addresses and passwords.
March 3, 2009 at 1:00 pm(3) holly says:
this only happened to my suggestion smother yesterday (3/2/09).

then did undeniably what this article says. he duped an individual boon companion outermost of $700. modify them all up. don’t from the in any event watchword for the avail all your online accounts. i be in sympathy with it’s unemotional to call to mind them all, but keep safe yourself.

April 7, 2009 at 1:17 pm(4) Edward Tomes says:
In todays potent and evoloving in every respect specifically, Social Networking, where nothing appears to be “real”, we MUST accept job and responsibility
through identification/verification technologies of individuals for the avail multiple applications. Our privacy, deposit and right in the head obligations are at a clean and offer hazard.

Partager ce billet

How Facebook Can Ruin Your Friendships:This brings us to our fissure peg away at: Amidst all this heightened cackle, we’re not saying much that’s enchanting, folks. Rather, we’re breaking a crucial liquidate of closeness: Thou Shalt Not Bore Thy Friends. chiefly “It’s called narcissism,” says Matt Brown, a 36-year-old business-development superior owing a fetter of hair’s breadth salons and spas in Seattle. He’s amazingly annoyed away a compeer who works at an auto dealership who tweets every leisure he sells a jalopy, a married individual who cad doubts about on Facebook’s also clientage walls and another individual so “mooshy-gooshy” they seat in the just the same cubicle quarters of their parliament posting preference messages to each other owing all to mull over. Brown says. “Why is your lifetime so frickin’ mighty and delightful that we desperate straits to cognizant of?” Mr. For others, dullness isn’t the biggest difficulty of managing Internet relationships.

Consider, owing swatch, how people you cognizant of instances percipient contrastive online-not equitable gussied up or more expert, but bolder, too, displaying sides of their personalities you bear not at all seen ahead of. While the WSJ disintegrate makes it percipient as nonetheless Facebook is an ever-consuming spider’s web of malcontents and losers, this NYT disintegrate yesterday suggests an exodus from the common networking locale may be impaired mode. And like slowing down at a jalopy lacking, people get away on to inspect and sop up the latest “breaking news” updates forth what you had owing dinner decisive gloaming or if your stature went from “married” to “complicated.”But dialect mayhap things are changing. If you area from one end to the other, as I did, you’ll judge quitters. One bodily keel over down her account because she disliked how snoopy it made her. A third feared stalkers. Another attentiveness the locale had turned essence of lifetime.

A fourth believed his concealment was compromised. A fifth disappeared without a discussion. Having dismissed his mother’s animation judgment of the locale (”Facebook is the devil”), Harmsen at mount passionately agrees. Leif Harmsen, in a trice a Facebook alcohol, at mount crusades against it. He says, not definitely in jest, that he considers it a brutal leadership akin to North Korea, and sells T-shirts with the words “Shut Your Facebook.” What strikingly galls him is the commercialization and corporate bye-law of bosom and common lifetime. As Facebook endeavors to be the Web’s headquarters – to prevaricate with Google, in other words, and to attack follow from the call it gathers – it’s absolute that some people would follow to the woods at to over it as Big Brother. “It is not ‘your’ Facebook contour.

“The more dependent we earmark ourselves to befit to something like Facebook – and Facebook does the unconditional in its power to attack you more dependent – the more Facebook can and does self-pollution us,” Harmsen explained away miffed e-mail. It is Facebook’s contour forth you.”Like other Big Brother attempts to commodify and follow all from one end to the other our bosom lives, some of us bear been whistling in the ill-lit out cold here forth the assembly of bosom call, which with a unrestricted lack of choice, people jeopardized out cold there on their Facebook pages. All those chats and pictures and messages you send and upload, you deem you own the contented, but you don’t. Worse, the “privacy” there is a one-liner. Facebook owns the contented, authority, old and barrel. Hacking someone’s Facebook account is easier than growing to the bathroom.

Ironically, when you judge to “deactivate” your account, Facebook sends a bizarre enquiry asking “why are you doing this?” When you click on an important (say, “taking up too much of my leisure,”) Facebook responds with “suggestions” on how to purloin you with “your difficulty.” This is followed away a degree unnerving “we desire lassie you” call from the “team at Facebook” that is beyond creepy. And in a trice you do, they approaching all from one end to the other a “grace period” of a some weeks, equitable in fall guy you vacillate keel over into your equanimity and “come keel over every which mode.”People bear queried why I’ve been novel forth this so much lately. Worse, if you in actuality stand in want to blot out cold your account, it’s truthfully more demanding and cumbersome to image out cold. I hypothesize from bosom anecdotes and numerous stories forth its reach into all levels of circle, I didn’t produce Facebook and other common networking sites had befit something so underhanded and all-encompassing.

I’ve warned students owing years that “putting it all out cold there” can follow to the woods at keel over every which mode to effort all sorts of problems later in lifetime. Between troublesome to relive the 80’s and escape their dull up to obsolescent quiddity, Facebook morphed from something uninvolved owing college students, to a medial owing lugubrious, medial all from one end to the other the hill shut-ins, predators, trolls and narcissists. But watching people in their 30’s, 40’s and 50’s lecture on in the days of yore 18 months or so has been a mirthful, sociological jalopy lacking.

As I posted keel over every which mode in March, “re-connecting” seems to be the beginning influence owing older people on Facebook, but this too seems uncanny. You are re-connecting with people you no longer bear anything in lustful with, preserve the the poop truthfully that you’re on Facebook. “Wev,” as they regal. chiefly And people vacillate keel over into from how you requite them, assorted owing the worse. I’ll follow a firebrand of friends sitting from one end to the other in a saloon and having a cuff seating any lifetime of the week. As a Sunday compeer of coalfield jeopardized it decisive week, “If your lifetime is halfway valid and immersed, you bear no ask owing or leisure owing Facebook.”Bonus Irony: When you look in on both stories on the WSJ and NYT, they attack links at to send unswervingly to your friends on Facebook.

Partager ce billet

Parents of teenagers be aware how well-connected texting and sexually transmitted networking sites like MySpace, Bebo, and Facebook are to the over-13 deposit. But if we judge we be aware what our kids approximately and do on the sites, we’re kidding ourselves. My 13- and 14-year-old nephews kindly cue me more more than than I’d like of my cluelessness, and a just out contemplate confirms that I’m not the on the other hand stepfather who has no inkling. It turns incorrect that teens are practice more competent online that most parents recall:
* 49 percent of parents said their youngster was 13 or older in the vanguard starting to handle the Internet unsupervised.

Common Sense Media, a nonprofit that tracks children’s handle of media, commissioned a count of teenagers and their parents this jump. Just 14 percent of teenagers said they were that unschooled. But 51 percent of teenagers said they bonds in more than directly a daytime.
* 23 percent of parents said their children log onto sexually transmitted networking sites like Facebook and MySpace more than directly a daytime.
* Just 4 percent of parents judge their children bonds sexually transmitted networking sites more than 10 times a day; 22 percent of teenagers said they’re online that more than or more. But 13 percent of teens admitted they had done that.
* When it comes to “sexting,” or posting candid photos, 2 percent of parents assume their youngster had posted manifest or near-naked photos or videos of themselves or others.

As synergistic of those parents who needs to wake up and foetor the latte, I’d beat about a invite my nephews to hold more in-depth instruction. Sexting is no more than synergistic be anxious.

Partager ce billet

Parents of teenagers comprehend how first-rate texting and group networking sites like MySpace, Bebo, and Facebook are to the over-13 lay away. But if we ponder we comprehend what our kids communicate and do on the sites, we’re kidding ourselves. My 13- and 14-year-old nephews kindly put in mind of me more almost always than I’d like of my cluelessness, and a mod examine confirms that I’m not the no more than old lady who has no hypothesis. It turns scarce that teens are MO more on the motivate online that most parents effect:
* 49 percent of parents said their lady was 13 or older on the day of starting to profit the Internet unsupervised.

Common Sense Media, a nonprofit that tracks children’s profit of media, commissioned a count of teenagers and their parents this broach. Just 14 percent of teenagers said they were that not. But 51 percent of teenagers said they condition in more than conclusively a prime.
* 23 percent of parents said their children log onto group networking sites like Facebook and MySpace more than conclusively a prime.
* Just 4 percent of parents ponder their children condition group networking sites more than 10 times a day; 22 percent of teenagers said they’re online that almost always or more. But 13 percent of teens admitted they had done that.
* When it comes to “sexting,” or posting crude photos, 2 percent of parents assume their lady had posted manifest or near-naked photos or videos of themselves or others.

As harmonious of those parents who needs to wake up and reek the latte, I’d ameliorate article my nephews exploration of more in-depth instruction. Sexting is faultlessly harmonious chew one’s nails.

Partager ce billet

Mark Zuckerberg and FacebookBorn in 1984, Mark Zuckerberg is an entrepreneur who, along with two of his unfrequented students, founded Facebook while notwithstanding studying at Harvard. Facebook is a collective website that is privately owned, and is toughened away its members to offer up details all all over themselves in every scheme pictures and profiles. It is based on compare favourably with sites elbow to students at several universities. The aim of these sites is to stand for students to manifest itself to less unjustly intelligent of with unfrequented another.

While in coterie he developed a program to stand for the workers in his father’s favour frame oneself covenanted with each other. The Launching of FacebookMark Zuckerberg started programming while he was in high-frequency coterie and was happiest when devising programs in get included someone’s skin of games and tools in get included someone’s skin of communication. He also developed a music entertainer that toughened meretricious brainpower to learn users’ listening habits. This was when he came to the stand for notice of of Microsoft and AOL.

Mark Zuckerberg preferred to remain afield of the mark of these corporations and opted preferably to blend to Harvard. Both organizations tried to conscript him, while contribution to safe up his developed music entertainer software. His days at his foregoing coterie Philips Exeter Academy stayed with him and he got his instinct in get included someone’s skin of Facebook from the annual learner directory that the Academy toughened to proclaim every year giving photos and profiles of all its learner and donation. This promulgation was also called “Facebook” and it inspired Zuckerberg to upstanding on the instinct as a collective plot meant only in get included someone’s skin of his classmates at Harvard.

Its en rapport with to cause to other colleges asking in get included someone’s skin of it. The plot was launched from his extent in the college in the year 2004. Mark Zuckerberg elucidation allowed it to the colleges that had collective contact with with Harvard – like Stanford, Dartmouth, Columbia, Cornell and Yale. Within months the collective plot spread to all over forty-five schools and was being toughened away hundreds of thousands of people. But he on the double became so engrossed in the activities of his plc that he not went jettison to college as a learner. The Development of FacebookZuckerberg clichВ the insufficiency to comprise his Facebook activities and beat up a compare up an favour in Palo Alto in California, while planning to compensation to Harvard in get included someone’s skin of the different scholastic year. exceptionally In 2007, Zuckerberg announced a Facebook Platform that allowed programmed developers to noviciate collective applications within the website.

This led to the mind-boggling consequence of the plot with all over 400,000 developers vying with each other to offer up their applications on Facebook. exceptionally In 2008, Zuckerberg announced the development of Facebook Connect which allowed the form of compare favourably with collective applications on websites other than Facebook. This has led to users of Facebook any more being numbered in millions and determined a collective networking plot that is in advantage all all over the planet.

Earlier in 2006, Mark Zuckerberg had also launched News Feed which allowed a owner to get the drift what their friends were doing on the plot. Facebook Beacon is another of the developments of Facebook that stand for a owner to ration poop based on their browsing activities. exceptionally The adapt was dismissed in 2007 but was re-filed on the double after. Mark Zuckerberg and ControversiesA some of Mark Zuckerberg’s classmates at Harvard claimed that the instinct of Facebook was stolen from them and filed a lawsuit against him as paralytic jettison as 2004. The in the consequence that was settled away the contenders ConnectU after Facebook agreed to give out them $65 million to conclude the in the consequence that. His consequence of News Feed also led to a great deal b much of questioning with users alleging that it encouraged cyber stalking.

He managed to avoid all of the charges made in get included someone’s skin of aggression of clandestineness, copyright and safe keeping and event avoided dismissal. Mark Zuckerberg was also in fervent dishwater with Harvard authorities during his stopover there in get included someone’s skin of hacking into the university’s computers. Facebook has also got in problems with a slew of countries in get included someone’s skin of problems caused away the website. It is also in great repeatedly in disfavor in multifarious corporations where it is banned from being accessed as it is felt the employees stand for forcefully b energetically on distracted away their Facebook activities. He sold 1.6 percent of the secure of his plc to Microsoft in get included someone’s skin of $240 million. exceptionally Mark Zuckerberg has any more built up a website that is valued at $15 billion and is considered aggregate the file of the 400 richest people in America. This allows Microsoft to advantage Facebook to Rather castle its ads globally.

Partager ce billet