Nathan, It IS an issue, don't let their foolishness harsh your mellow. Although it's a completely ridiculous, backwards, and standards-relaxing "security" mechanism, the fact is they implemented it, and you subverted it.
In my book that's Pentester 1 :: Fail Vendor 0 I've had large vendors (read:Microsoft) reply to issues with the same kind of garbage, where they take a situation where there wasn't a threat, create a "security" mechanism to counter the nonexistent threat, then implement it incorrectly, thus creating either a vulnerability in the system itself or a false sense of security for the user. Fail: "Hello user, you can add attachments now! Look at our amazing 1997 web technology!!" User: "Oh neat, I can't wait to send my friend this random file (read: give up your rights and control of your random file to facebook) your through your excessive, unnecessary, inefficient, insecure, closed-source tool" Fail: "I am blocking exe attachments 'for your security' so feel free to just run attachments without a second thought, don't even bother to waste 100ns of your time to practice normal security" User: "Wait, what about .bat, .cmd, .vbs, .ws, .pif, .inx, .lnk etc etc? What about the extensions that I set up? Can I really just spam clicks all over the place?" Fail: "Oh those, well you shouldn't be clicking those. What, we can't be held responsible if you don't practice normal security!! P.S. You know when we said we were blocking .exe files? Well--- we aren't. Enjoy." </rant> On Fri, Oct 28, 2011 at 1:38 PM, Nathan Power <[email protected]> wrote: > I was basically told that Facebook didn't see it as an issue and I was > puzzled by that. Ends up the Facebook security team had issues reproducing > my work and that's why they initially disgarded it. After publishing, the > Facebook security team re-examined the issue and by working with me they > seem to have been able to reproduce the bug. > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
