Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

This question already has an answer here:

What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last evening (US time). What do we know and what can we surmise about this event?

Intuitively the actions I saw yesterday seem to have bypassed fundamental security features of modern browsers/web servers/DNS. What do the results of the error tell us?

/EDIT UPDATE/ To be clear most users like myself were not using nor had ever used Facebook Single Sign On on the pages that were affected.

share|improve this question
1  
Not available = high security. Nobody can access it, so it's thoroughly safe. Basically, all unified login systems promoted will have this problem. if the service goes out, no access. – Fiasco Labs Feb 8 at 20:28
I gave this question a +1 because I believe there's going to be a lot of readers coming in to check on IT.sec, if that was a security related event or not, given how many news editors overhyped this as a possibility due to sheer lack of their fundamental understanding of such basic things as @FiascoLabs pointed out. – TildalWave Feb 8 at 22:14

marked as duplicate by AJ Henderson, Scott Pack, dr jimbob, Iszi, Rory Alsop♦ Feb 11 at 13:32

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3 Answers

up vote 1 down vote accepted

Not real hijacking but serious security concern anyway!

Ok, journalist love to use strong words. So placing hijacking in title is right for trapping readers.

I'ts not really an hijacking as the link was present on victim website intentionally.

But.

As some of this sites are securised, while facebook don't, I think there seem to be a trick to work around for finding something like a way to create a MITM be cross-site scripting. (Putting a trap page on facebook is trivial).

Edit:

To be more explicit: If this case don't have a direct security implication, it reveal one possible way of doing something like:

  1. breaking facebook (certainly hard to do, but surely less than breaking the lot of banks who hold a facebook-i-Like button on website.)
  2. corrupting errors and redirections pages for redirecting to a pirate site in sending origin for good site template selection.
  3. spoofing design and look of asked site.
  4. collect victim password and initiate a MITM transaction corruption.

... In the hope, the victim (who have clicked on usual like or hited correctly URL in browser) will do his transaction without carefully re- read the URL bar of his browser...

But anyway, if you click an usual link, when you see the correct site coming, are you confident or did you do every time a URL bar check?

Nota: If well worked, I could figure a bot that do the job for point 2 and 3 ... and 4.

Remember: In this story, user did'nt click anywhere before redirection! According to my point of view, this is a serious security concern!

My conclusion/recommendation

I think that site having real security concern (like banks) must whipe such kind of links out of their websites, until concern will be completely reviewed.

share|improve this answer
up vote 9 down vote

From what I can tell from that article it was an error with the Facebook "Connect" API.

This is the button on a site that says "Log in with Facebook". It is just a link the site owner puts on the page. When the user clicks it, you are redirected to Facebook's server. The site owners have no control over what happens after this.

It doesn't "bypass fundamental security features" because the site owners willing placed a link to Facebook on their site. They trust Facebook to behave, and they didn't.

Now that I think about it, it's kind of dishonest that this article used the word "hijack" in the headline. It doesn't sound like a security issue at all. The headline may as well have said "Facebook connect was down. Had an error." Please fill me in if I'm misunderstanding.

EDIT: It did not require a button click as I had inferred. Here is the javascript clusterfuck that sites embed for Facebook Connect: http://connect.facebook.net/en_US/all.js

share|improve this answer
3  
+1! Small part of Facebook was buggy or went down, many websites depended on that part, they went down with it. I see no security implications. – Adnan Feb 8 at 18:59
At first I was like, "woah, Facebook hijacked reddit? I should have noticed that!". I looked at a couple sites, "Log into Facebook" is just a simple hyperlink. No embedded content under Facebook's control, etc. – Cory J Feb 8 at 19:02
Facebook Connect login service was failing to deliver, people using their third party login method weren't able to connect. Failure to connect isn't a failure in security, rather the opposite, it's so secure you can't access anything. Kind of along the lines of an Outlook/Live/Hotmail outage, if you don't use Hotmail, you probably didn't know or care. – Fiasco Labs Feb 8 at 20:26
No button was clicked, no SSO was used. Please see my update and check documentation of event. – zedman9991 Feb 8 at 21:31
@Zedman9991 - most likely there is a portion of code in the affected sites that calls out to Facebook for content, even if it isn't authentication. That call returned a redirect, which the server you were connecting to rendered to the browser. The browser followed this and redirected. It isn't a hijack as the site you were connecting to was linking to off-site content. An error caused that content to change and in caused unexpected redirects, but it is simply an error, not a security issue. All it really says is "do better error handling when using third parties" to the affected sites. – AJ Henderson Feb 8 at 21:39
show 3 more comments
up vote 1 down vote

There isn't really much of an implication to security in this event. It wasn't linked to any compromise and was simply an error by a service provider. It does illustrate how widely used services like Facebook have become entangled with Single Sign On systems, but that isn't necessarily a bad thing strictly speaking as long as the single sign on isn't used for sites needing higher security (such as financial and medical sites).

There was no actual "hijacking" and the use of that term is more or less just media outlets trying to generate hype by indicating that an error by Facebook caused many sites to have unexpected errors.

share|improve this answer
AJ most users like myself had never used SSO for the redirected pages... – zedman9991 Feb 8 at 21:28
@Zedman9991 - what behavior did you observe, there was no hijacking at all, only a service was out. If a site had poorly implemented their sign in page and supported SSO, it wouldn't have mattered if you were using Facebook for your sign-on or not, it still could have errored and caused a redirect. – AJ Henderson Feb 8 at 21:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.