Researcher sends executable over Facebook

Powered by SC Magazine
 

Trick the parser.

Researchers have discovered a way to evade Facebook security controls to deliver a message on the social networking site that contains an executable file.

Facebook normally strips out messages that contain executables from its private messaging feature. But a yet-to-be-fixed vulnerability, discovered by penetration tester Nathan Power, could enable someone to undermine these security controls by altering the 'POST' request, which is used to send data to a server.

The researchers captured the POST query that is sent when attempting to upload an attachment, and altered the coding.

"It was discovered the variable 'filename' was being parsed to determine if the file type is allowed or not," according to the vulnerability disclosure. "To subvert the security mechanisms to allow an .exe file type, we modified the POST request by appending a space to our filename variable."

Doing this allowed the researchers to "trick the parser" and attach an executable to the message.

A bug like this is dangerous because it could allow criminals to send messages that contain malware. Power reported the vulnerability to Facebook on 30 September and the company acknowledged its existence on Wednesday.

A Facebook spokesman said the exploit, as diagrammed by the researcher, would not impact a recipient.

"The attack...would only allow a user to send an obfuscated renamed file to another user, but this file would not execute on a recipients machine," the spokesman said, adding that Facebook also relies on anti-virus technology to weed out potentially malicious files.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Researcher sends executable over Facebook
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  25%
TOTAL VOTES: 346

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 144

Vote