Feeds

Student reprimands Facebook for bad manners and exposed code

Rebuke comes amid new leak of purported Facebook code

Securing Web Applications Made Simple and Scalable

McNeely expected that would be the end of it until the code ended up surfacing on Facebook Secrets, a site hosted on Blogspot that appears to have been created following the code leakage. Despite the formidable firepower of Facebook's legal team, the code remains on the Google-owned site at the time of writing, more than 72 hours after it first went up.

What's more, a second entry was made to Facebook Secrets that purports to offer another sampling of Facebook code. Facebook didn't respond to our request for comment, so there was no way for us to confirm the claim is genuine. (The code wasn't a part of the posting McNeely made over the weekend, and he says he has no idea where it came from.)

But Robert Hansen, a security researcher specializing in Web 2.0 applications, has examined the latest disclosure and said it appears to be as advertised. For example, one section beginning with the line require_js('js/editregion.js'); clearly corresponds to this section of the Facebook site.

And that raises questions about security on the site. For one thing, if it proves to be actual Facebook source code, it suggests leaks are more common than company spinmeisters would have us believe. More importantly, the latest disclosure, in contrast to the first one, goes well beyond the mere reprinting of interface code, which is of little use to someone looking for security holes.

"It gives enough information for an attacker to know where they should or shouldn't be attacking," Hansen said of the latest code disclosure.

The company said yesterday that configuration errors led to the leak of a limited amount of code and assured users security was just fine. Nothing to see here. Move along.

But like Hansen, McNeely isn't so sure. The second thing the Oklahoma grad has derived from the episode is that the Facebook can leak like a sieve. He says this isn't the first time PHP code has spontaneously appeared on his browser while surfing Facebook, and that's made him think twice.

"The type of error they got because of some misconfigured server, that tells me they're not secure," he said. "I'm not a programmer, but I can read code. In my opinion facebook is vulnerable." ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.