Very interesting -- I wonder if this is the result of having so many API access points. The documentation page lists FBML+FQL, Graph, "Old Rest API", and "Old Javascript Client Library" as options: http://developers.facebook.com/docs/ Or are we back to good old XSS attacks?
It would be rather poetic if he just used firesheep, but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. Possible, but unlikely.
With apps on both the iPhone and Android wouldn't it be possible for his phone to poll the FB site in the background without his knowledge?
EDIT
I know 3G is encrypted. What I'm wondering though is if you ever let your phone join an unencrypted wifi network (say at a coffee shop) would it remember the network and then join again automatically the next time you are there?
Possibly. Worth an experiment, at any rate. I suspect the behaviour in question would depend upon the phone, unless the iOS/Android/BB apps are all functionally the same.
I'd be interested to see if an optimized implementation of that attack could be run in a convenient timeframe for a cafe-sniffing attack. The article you linked mentioned a 2 hour attack window; something in the sub-15 minute range would be a pressing concern.
Only something in the sub-15 minute range would be a concern for you or me, but don't forget that this is Zuckerberg - it's not at all impossible that someone followed him around for 2 hours to crack his GSM encryption.
> but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless.
He'd just have to be logged in, not specifically accessing his fan page, and there's a nice Starbucks near the Facebook campus in Palo Alto that has free (unencrypted) wifi. Or maybe that's all Starbucks these days...
Target: the moderators/judges of the facebook coding contest
Approach: post links on the contest page to a site that claims to know future questions, write code for you, process your data whatever. They'll get deleted but some staff will inevitably want to check if it's legit.
Method: Today's money is on the IE CSS use after free bug - unpatched and widely available. Get some ie traffic by "this site requires Internet Explorer". Some other month it'd be a jre/flash/quicktime/pdf.
Execution: Transitory system access on one or more clients. Reverse shell or basic payload, good rootkits are expensive. Simplest is just copy cookies/autofills/saved passwords/ssh keys - for extra credit install a keylogger.
Low and behold, poorly_paid_intern not only despams the contest page but does the same for zuck's pr account.
IMO not a local wireless attack - who on the peninsula would have such a idealized view of facebook's financing? Also US citizen+high profile=bad idea, see doing a year for guessing Sarah's yahoo.
Nine times out of ten a targeted intrusion like this will have been the result of a spearphishing attack - malicious pdf, malicious link etc sent directly to a small chosen set of people.
I'm not personally familiar with how a high traffic fan page like this is managed, but I guess a fair number of people have access to it to delete spam, forward on interesting messages etc. It seems to me that a lot of those people might have the technical ability to post a new message - they may just be constrained by policy. So that's perhaps dozens of potential unsophisticated targets - interns, junior PR staffers. Like shooting fish in a barrel.
Ah. I guess it's always been there. I was just expecting the title to match Firefox's "remove individual cookies." Reminds me of the "Add/Remove Programs" -> "Programs and Features" switch between XP and Vista.
Drunk intern that left three months ago and no password change policy on the account (*which I assume is used by the PR department, not Zuckerberg himself) .
Does facebook use captchas, to slow bruteforcing, I tried entering a few wrong passwords for my account but didn't get one. However I doubt that bruteforcing or a dictionary attack was used.
captchas really aren't particularly suited to the task. The difference between even the most forgetful user and the lowest key bruteforce is so many orders of magnitude that it should be trivial to detect. I have no idea what facebook does, but most services just make it too slow to be practical: progressively slower responses, rate limiting, lockout periods. Another approach is to fail all authentications over a rate limit so that even if the correct password is guessed the attacker doesn't know. Long story short is defending a service against brute forcing is generally pretty easy.
facebook doesn't use captcha's as much as it does other security features. if there is a log-in from an ip address that seems suspicious, it can ask you to identify your friends in photos to verify your identity.
Which is actually so much less annoying than captcha. Seems less secure (probably trivial for people you know to break in) but it's certainly a novel approach.
Unnamed hacker reinvents IPO, tells world.