Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Facebook Security IT

Facebook Rolled Its Own 0Day For Red Team Exercise 40

Posted by Unknown Lamer from the and-yet-they-were-hacked dept.
chicksdaddy writes "Threatpost has the story of the extreme — even hair-raising — lengths that Facebook's incident response team has gone to in order to prepare the company's staff to be hacked. Among the methods described at the CanSecWest Conference: 'Operation Loopback' in 2012, which was designed to mimic an APT-style attack from China and used what appears to be an internally developed exploit for an internally discovered 0day. From the article: 'McGeehan and his team this time identified a likely attacker — China — and decided to impersonate its tactics. For this one, they recruited an internal engineer as an accomplice. They wanted to get a backdoor into Facebook's production code, so they sent a spear-phishing email containing exploit code for a live zero-day vulnerability to the engineer. He dutifully clicked the link and his machine was promptly compromised. (McGeehan would not identify which product the vulnerability affected, nor how the Facebook team came into possession of it, but said that they disclosed it to the affected vendor before the Loopback exercise and used it before the patch was publicly available.)' Ouch!"
This discussion has been archived. No new comments can be posted.

Facebook Rolled Its Own 0Day For Red Team Exercise More

Facebook Rolled Its Own 0Day For Red Team Exercise

Comments Filter:

  • Ofcourse It had to be China (Score:2, Insightful)

    by Anonymous Coward

    I mean, with the soviets gone, Sadam gone, Bin Laden gone, SOMEONE has to step up to be the stereotype arch-enemy of the US. So let's build this image because hey, we just have to learn and be prejudiced with 1 and a half billion people. After all, what good are the chinese for? We don't need them right?

  • Sounds like Facebook handled it correctly (Score:5, Insightful)

    by excursive ( 2823185 ) on Saturday March 09, 2013 @07:20PM (#43128325)
    More companies should do that kind of testing. If only they would spend that much effort on building a reliable user interface...

  • Correct me if I'm wrong but it's not really a zero day 'sploit if it's internally known, the attack is internal penetration testing, and the exploit gets closed before it's known.

    • This is Slashdot, where every exploit is a zero-day exploit. I could release a patch to TRS-DOS 1.3 that makes it ignore passwords and someone here would post it as a zero-day.

      But I believe that patch already exists.

    • Re: (Score:1)

      by WizADSL ( 839896 )
      I imagine the team(s) that responded to the security threat didn't know it was a drill. I think the idea was to create the situation using a real security hole but with the cooperation of an engineer that was playing the part of a "tricked" employee to allow the vulnerability to be exploited in a realistic way. I ASSUME that the team members responsible for the creation of the exploit program were not part of the team(s) that responded to the incident.
    • Comment removed based on user account deletion

Slashdot Top Deals

Whoever dies with the most toys wins.

Close