Sindows 7
join:2006-09-13
Hope, BC
|  Amateur Programming Error Exposes Facebook Code
Owing to a misconfigured server, Facebook exposed its homepage code to what the company called “a handful of users” over the weekend. The leaked code was promptly posted on a new blog, Facebook Secrets, for all of the internet to see.
Although Facebook hasn’t specified what exactly was wrong with the server, it seem reasonable to conclude that some sort of mod_php error caused apache to serve the code as an ordinary text file rather than processing it as PHP.
The code leak does not constitute a security breach and there’s probably no immediate reason to be concerned about your data. However, given the number of PHP includes and auxiliary file paths listed, hackers now have a much better idea of how Facebook works and where potential vulnerabilities may lie. And it’s hardly comforting that such an amateur programming mistake is happening to a site the size Facebook.
PHP is notorious for just this sort of thing — serving code as text — but there are ways you prevent it from happening on your own site. The easiest and most effective way is to use the Apache module mod_security, which can detect and stop PHP source code from being sent at plain text.
Regrettably for Facebook, the site apparently wasn’t using mod_security on the particular server that was misconfigured.
One group that should be quite happy with the leak is ConnectU, the company currently embroiled in a lawsuit with Facebook which alleges that the latter stole code from the former. If the alleged code happened to be on Facebook’s front page, ConnectU’s case just got a whole lot stronger, though ConnectU hasn’t said anything to that effect.
Given the amount of personal data that many people have dumped into Facebook, an outside security breach would likely lead to an identity theft nightmare, should it ever happen. And if this weekend’s code leak is any indication, Facebook doesn’t seem to be operating at the security level you would expect from a site of that size |
