Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Facebook Privacy Social Networks

Facebook Intern Gets Preemptive Ax For Exposing Security Flaw 103

Posted by timothy from the because-they're-all-edgy-and-wear-hoodies dept.
Engadget reports that Harvard student Aran Khanna, who was about to begin an internship at Facebook, had that internship yanked after he created (and took down, but evidently too slowly for the company's taste) a browser plug-in that exposed a security flaw in Facebook, by allowing users to discover the location of other users when they use the Messenger app. Surely Khanna won't be jobless or internship-less for long. (Don't expect the app to work now; it's still in the Chrome store as a historical artifact, though, and at GitHub.)
This discussion has been archived. No new comments can be posted.

Facebook Intern Gets Preemptive Ax For Exposing Security Flaw More

Facebook Intern Gets Preemptive Ax For Exposing Security Flaw

Comments Filter:

  • What did you expect to happen? (Score:5, Insightful)

    by OverlordQ ( 264228 ) on Thursday August 13, 2015 @10:02AM (#50309139) Journal

    So you're trying to get a job at a company and instead of reporting to them a security flaw, you create a Chrome extension to let anybody (ab)use it.

    If you're expecting to NOT get fired, you're an idiot.

    • Re:What did you expect to happen? (Score:5, Interesting)

      by alvinrod ( 889928 ) on Thursday August 13, 2015 @10:14AM (#50309257)
      Sounds like a classic case of a brilliant engineer/programmer simply lacking in common sense, perhaps in this instance due to being young more than anything.

    • Re: (Score:1)

      by Anonymous Coward

      Better than that, the app is still up, it was never even removed - he only removed one version of it:

      https://chrome.google.com/webs... [google.com]

    • Re:What did you expect to happen? (Score:5, Interesting)

      by buchner.johannes ( 1139593 ) on Thursday August 13, 2015 @10:20AM (#50309335) Homepage Journal

      It is not really a security flaw, it is a choice of design, and the extension showed what the consequences are -- namely that you can find out the habits and travels of a person, remotely.
      This is similar to the mobile phone metadata, from which you can learn everything* about a person

      Netherlands: https://www.bof.nl/2014/07/30/... [www.bof.nl]
      Germany: http://www.businessinsider.com... [businessinsider.com]

      *You put in some assumptions too, and being very confident about the conclusions of that person may have low validity, but that hasn't stopped the NSA.

      • That just makes it worse: telling someone that they made a mistake pisses them off; but telling someone that the consequences of the action they deliberately undertook suck is just unforgivable.

    • Re: (Score:2)

      by mwvdlee ( 775178 )

      How obvious was is that it was indeed a flaw, and not just some "hidden" feature exposed through the publically distributed HTML and javascript?

      • It *wasn't* a flaw. He didn't write an exploit, nor is this a security vulnerability. He just wrote a scraper for location metadata that was already there and was intended to be there. There is no vulnerability, just a demonstration of the extent of the data that is already normally, deliberately available. The only mention of "security" is in the Slashdot summary, which is garbage, as usual. The only thing the extension does is take location data that you can already see and plot it on a map.

    • Of course it might be an intentional backdoor to allow NSA, DHS, FBI, law enforcement to track persons of interest so you can be SURE facebook would be upset that it was made public as would the three letter Federal agencies using it.

    • Re:What did you expect to happen? (Counterpoint) (Score:5, Insightful)

      by willworkforbeer ( 924558 ) on Thursday August 13, 2015 @11:51AM (#50310099)
      I disagree.. this "idiot" cleverly parlayed an unpaid internship 'firing' into fame and notoriety to get noticed and then hired by a security company; you can't buy this much press even on a Harvard tuition budget. He had a bigger plan all along, and will be hired by a firm in the area of his interest.

      Such a firm will be smart to do so. And they will not fail to capitalize on this new hire... they will highlight that one of their employees, [begin bio and / or press release] "...recently made international news by demonstrating a critical security / privacy flaw in FaceBook's messenger application, a flaw that potentially affected hundreds of millions of unsuspecting at-risk FB users".

    • So you're trying to get a job at a company and instead of reporting to them a security flaw, you create a Chrome extension to let anybody abuse it
      If you're expecting to NOT get fired, you're an idiot.

      Better still is this bit of idiocy from the poster:

      Surely Khanna won't be jobless or internship-less for long.

      The geek lives in this fantasy world where you can be fired for cause for a security breach at a Fortune 500 company and still remain employable.

      • The geek lives in this fantasy world where you can be fired for cause for a security breach at a Fortune 500 company and still remain employable.

        I actually agree with you in general, but a single data point to the contrary.

        (info from Wikipedia). Kevin Mitnick went to jail for 5 years, and currently:
        He does security consulting for Fortune 500 companies, performs penetration testing services for the world's largest companies and teaches...

      • The geek lives in this fantasy world where you can be fired for cause for a security breach at a Fortune 500 company and still remain employable.

        ...Why wouldn't you? Companies take risks all the time. To them, you're merely an investment who can pay off richly or blow up in their faces, just like any other. And frankly, adding one more leak to a sieve isn't much of a crime.

    • What makes you believe he didn't go to his manager with that extension and showed what it does first, and tried to explain why it's a problem?

      This being Facebook, though, I expect that they simply laughed him out of the room with, "privacy? who the fuck cares about privacy?". And so he published it to show who cares.

    • it's a feature.

      turn off location tags if you don't want them.

      they didn't want him to intern because the way he was presenting the stuff, I think. or because he cannot tell a software flaw from a feature.

      • If it wasn't a bug, they wouldn't have changed the way that the app handles location data (and they did change it).
        If they didn't want people tracking the location data of Facebook users, they shouldn't have exposed the users' locations by default.
        If they didn't want people to release a tool for automatically mapping that data, they should have paid attention the first few times the issue come up in the media.

        Facebook doesn't deserve this guy. There are much better companies he could be working for.

    • Re: (Score:2)

      by guruevi ( 827432 )

      Are you sure it was a flaw or was it more of an 'undocumented feature'. Because in the end, this is Facebook we're talking about.

    • Which part of

      who was about to begin an internship

      did you misunderstand?

      Anyway, it's not a job if there's no pay packet - which is what I understand by "internship" instead of "job".

      OK, it's not the best of ways to start your relationship with a company, but part of the induction process at the start of employment (oh, sorry, it's an internship, not an employment) is informing the employee (internee) of their employment rights (not an American concept, I know), the procedures for grievances, their obliga

  • What? They yanked an internship away from someone who released an exploit for their platform?

    • Re: (Score:1)

      by Anonymous Coward

      Did you read the article? It wasn't an exploit. It was a feature working as intended.

    • Yes you are talented. Yes you helped us find a security flaw. But you are too stupid and irresponsible to publish it on the Chrome store. The right way to impress your future employer is to demonstrate it to them, privately.

      Can I get a job with Secret Service by penetrating them to approach within 10 feet of Obama?

      • Re: (Score:2)

        by N1AK ( 864906 )

        Can I get a job with Secret Service by penetrating them to approach within 10 feet of Obama?

        Maybe, but what this guy did was the equivalent to putting out a method for getting past the secret service and near to the president on the internet for anyone to see which is far worse.

  • Missing ')' (Score:4, Insightful)

    by Anonymous Coward on Thursday August 13, 2015 @10:05AM (#50309169)

    Can someone close that parenthesis? It's driving the LISP part of my noggin nutty.

  • And make him find more exploits and publish them. But too late for GooglePlus that's doomed now.

  • Clearly a "flaw" they wanted to protect (Score:4, Insightful)

    by smoothnorman ( 1670542 ) on Thursday August 13, 2015 @10:17AM (#50309285)
    Some (inspired) companies provide rewards for discovering flaws in their products; allowing them to improve them under controlled circumstances. Some (shorted-sighted) companies punish the discovery of product flaws, preferring the illusion of a pristine public image over the security of their clients. Yet this is clearly a third case: that of it being an intentional "flaw" which was intended to provide revenue. So, if there was such a thing as justice at this level (there isn't) then Facebook should be doubly embarrassed.

    • Re: (Score:2)

      by dmomo ( 256005 )

      Please tell me which companies reward their engineers for publishing security flaws.. and how could that be considered a controlled circumstance...
      If by "clearly", you mean "very unlikely", then surely you are correct.

      • (something tells me lacking all manner of references and affidavits this will be a fool's errand, but...)

        Fluke and Tektronix for two. and I know one Boeing engineer who got a raise when he pointed out a major "flaw" in one of their QC servers. "controlled circumstance" in that it's an in-house discovery with no screaming clients demanding a fix yesterday (cf "zero-day")

    • Some (inspired) companies provide rewards for discovering flaws in their products; allowing them to improve them under controlled circumstances.

      But this wasn't "controlled circumstances". This was someone releasing a product that used that flaw/design decision (as others have called it) in a way that the company didn't intend, and in a way that apparently the company didn't like.

      If they had reported it *directly* to the company, especially after starting the internship, maybe they would have been rewarded

  • While this is more due to limitations in said masters and their organizations, it is nonetheless a very important rule. If you must do it, then do it privately. If you need not, then do not do it.

  • here are your choices:

    1. employee or white hat or grey hat comes to you with an exploit. you reward him for the discovery, you squash the exploit. the media paints you in a good light. more white hats and employees are eager to come forward with exploits they find. your userbase is happy with the quick resolution, transparency, and eagerness to protect

    2. employee or white hate or grey hat comes to you with an exploit. you fire him, sue him, ignore him, censor him. maybe you don't squash the exploit, you think you can just hide it. of course, the media gets wind anyways and paints you as a moron who thinks you can sweep it under the rug or an idiot in denial for your "no comment" when asked about the exploit. white hats and employees are discouraged and hide exploits or, turn into grey hats and black hats and sell your exploit underground or use them for nefarious purposes themselves. you don't find about it until much later as no one wants to talk to you after the reception you've demonstrated. you are hacked, your userbase grows angry and shrinks, your third quarter profit takes a hit, the guys in the corner office call you in and ask you to account for the problems

    those are choices middle management morons. proceed accordingly

    oh, the guy wrote an app instead of coming to you immediately?

    gee, how horrible

    hide your blind shortsighted anger, paint on a fake smile, and give him a reward

    because that's what is in your best interests you fucking pinhead! you WANT these guys to come to you, so you NEVER show any negativity to anyone who has shown how YOU have failed by discovering the exploit. the original shame, the original failure is YOUR EXPLOIT

    it's not a parent-child situation and the kid crashed the family SUV. it's about you failing to provide airtight security with your product and you showing the world that you are welcoming to all friends and foes who would only come to you and tell you what you did wrong to allow the exploit. understand? you failed first, by allowing the exploit to exist

    oh, all complicated software has exploits? true. so you're really eager to plug those holes any way you can, right? you're really glad someone found one for you, right? prove it, by rewarding those who find the holes

    either the exploits go underground when you storm around like a prima donna when someone finds a hole, or you show how eager you are in due modesty that anyone come forward with an exploit for you to squash, with thanks and kudos

    now figure the fuck out what is best for you and your company's bottom line, and don't be such a mediocre empty suit

    • Re:dear clueless megacorp and mediocre middle mgmn (Score:5, Interesting)

      by RatherBeAnonymous ( 1812866 ) on Thursday August 13, 2015 @11:39AM (#50309979)

      The curios part about this is that this privacy leakage flaw has been know since 2012 and was reported in the media. Facebook didn't care.

      Aran Khanna MADE Facebook care. I don't know if he was trolling Facebook or if he is just naive. Either way, I applaud his results.

    • Re:dear clueless megacorp and mediocre middle mgmn (Score:4, Informative)

      by phantomfive ( 622387 ) on Thursday August 13, 2015 @12:07PM (#50310229) Journal
      Consider it another way.....his life will now be measurably improved by working for a company besides Facebook.

  • Wondering what percentage of /.ers is trying to track their (imaginary)girlfriend/wife/goat with this right now...

  • You people are idiots (Score:4, Informative)

    by Anonymous Coward on Thursday August 13, 2015 @11:04AM (#50309687)

    It was published THREE YEARS ago by CNet and others. What the fuck was he supposed to disclose exactly? I'm sick and tired of people not doing the minimal amount of reading necessary to avoid rail roading a privacy researcher with a priori judgments.

    Also it's not a security flaw, its a feature: they push this data to your box. All he did was write some JavaScript to display it on a map.

    • Already commented so I can't mod this myself, but: yes, this. Exactly this.

      I'd like to emphasize here that among "you people" one must, prominently, include Timothy. None of the linked articles call this a "security flaw", and calling it that anyhow is just intellectually dishonest bullshit.

  • From Facebook's official statement: (Score:2, Funny)

    by Anonymous Coward

    "KHAAAAAAAAAAAAAAAAAANNA!"

  • I thought the FB mobile app already gave you the ability to click on messenger-based messages to see where they came from? How is this a flaw?

    • It's not a flaw of architecture or implementation. They implemented it this way on purpose. Its a flaw because they either didn't see or envision someone using the data they provided in a way that they thought made them look bad. And it does. He also brought to light to the world that this information was freely available with their implementation when they would have rather kept that a secret to the general public. Because of the public starts to realize how much of their information is available to o

  • Stop using Facebook - it's not that hard! (Score:1, Insightful)

    by Anonymous Coward

    Stop using Facebook - it's not that hard!

  • If Facebook was really as forward thinking and revolutionary in any kind they would have kept that young fella and offered him a permanent position on the security team. Punishing people for such actions is just old style HR policy. Sure, he should have gone about it differently maybe, as in not making it a publicly available tool, but the core of the issue is that he found a significant vulnerability on his own. It is just too typical that folks get punished for a job well done, either by firing them, givi

Slashdot Top Deals

Children begin by loving their parents. After a time they judge them. Rarely, if ever, do they forgive them. - Oscar Wilde

Close