Facebook shocked the world by unveiling its new Graph Search. Where users are waiting to test the new search features, the hackers are anxiously waiting to test their skills to hunt some Facebook accounts.
Facebook’s Graph Search is basically a search engine which will work within the network, finding results based on posts, tags, friends, families and uncountable Facebook members.
Its an undeniable fact that this new Graph search engine is a genius concept and very useful medium of search based on your friends and their interest. For example, your friends who like Miami Vice and living in Miami or your friend’s Favorite coffee shop nearby.
Yet, Graph search will also act as a heaven for the attackers as Andrew Storms, director of security operations for nCircle, says:
The new Facebook Graph Search is a phishers’ dream come true. It takes the micro-targeting capabilities that have been available to online advertisers for years and puts them into the hands of cyber criminals.
Just like Google hacking, where the endless useful information can be found, vulnerable servers, social engineering tool, sensitive data, files containing passwords, juicy information, web server directories, hence the endless help for hackers can be found on Google.
Facebook Graph Search is adding more juice to it by providing same service as Google but with more personal context.
CORE Security‘s security strategist Alex Horan explains the upcoming headache for the Facebook users:
This means Facebook will want it to have as much information available as possible to respond to each query, ensuring people have a positive experience. This directly goes against the desire expressed by people to keep their information private.
By using Graph search, the attacker will be able to gain more personal and up to date information on the victim by matching their current info with the one available in past.
Richard Wang, manager at Sophos Labs, says that:
Graph Search might be a startling eye-opener for many. This will probably lead more users to discovering that they have shared more than they expected and gives scammers the opportunity to target particular groups of people.
Robert Scoble praised the privacy model behind the tool. Scoble explains:
“You can only see items shared to public or shared with you specifically due to your friend arrangements.”
PC World reports that That is true, and Facebook deserves credit for building in privacy controls. Unfortunately, many of the billion-ish Facebook users aren’t aware of, or don’t properly use the security and privacy controls—so everything they post on the social network will be easily discoverable by cyber criminals.
Horan clarifies, “From a hacker’s perspective, the data was already there and subject to target an attack, but this new feature makes it easier for attackers to collect similar targets for a more customized attack.”
“If you thought the level of spam and phishing scams on Facebook couldn’t possibly get worse, I have bad news for you. We ain’t seen nuthin’ yet,” warns Storms.
![[hlink][/hlink] CPDoS can be used to attack content delivery networks (CDNs) to serve error pages instead of legitimate sites through caching. Freshly termed as a Cache Poisoned Denial of Service (CPDoS) attack, two academics from the Cologne University of Applied Sciences in Germany have discovered [PDF] how content delivery networks can be attacked to serve error pages instead of legitimate sites through caching. In normal circumstances, when the user re-visits a website, they are served a cached version of it through a content delivery network such as Cloudflare. On the other hand, during the poisoning process, the attacker visits a website with the intention of generating a request for the web page from the CDN. However, the request, in this case, contains a malformed header which can be from the following 3 options: [wp_ad_camp_2] [wp_ad_camp_1] An HTTP Header Oversize (HHO) An HTTP Meta Character (HMC) An HTTP Method Override (HMO) Any of these, in turn, cause an error on the webserver. As a part of regular operations, the error page is then cached on the CDN and in turn served to legitimate users. Slowly, it spreads to other nodes of the CDN as they are updated hence giving the impression of the site being unavailable globally successfully completing the attack. This could cause both a reputational loss and financial losses as well for mission-critical websites. This was further confirmed by the researchers themselves along the lines of, To get a clearer picture on the real life impact of CPDoS attacks, we took some samples based on the URLs from the Alexa Top 500, DoD, and HTTP Archive data sets. Overall, we found twelve vulnerable resources within a few days. These also include mission-critical websites such as ethereum.org, marines.com, and nasa.gov which use CloudFront as CDN. At all these websites, we were able to block multiple resources including scripts, style sheets, images, and even dynamic content such as the start page. [hlink][/hlink] Example screenshot on Marines.com website: An example showcased by the researchers of a before and after scenario of the attack on Marines.com. For those of you wondering when your site is getting poisoned, you can relax and luckily take a series of precautions. The first one is that you could turn off the caching of HTTP error pages by default on your CDN service through predefined options or by editing your server's configuration files. Hence, the error page will never be distributed by the CDN en masse. [wp_ad_camp_2] [wp_ad_camp_1] Secondly, you could make sure your CDN provider is complying with standard caching protocols. One of these involves caching only certain error pages such as the "404 Not Found" but not others such as the "400 Bad Request" one which is generated because of such an attack. A table allowing one to analyze the errors different CDN providers cache. Continuing with the often seen pattern in the cybersecurity world, these revelations were also followed with responsible disclosure leading to companies like Microsoft and Amazon taking action to fix the problem at hand. However, some companies like Flask have still not responded according to the researchers and so it is yet to be seen how the customers of such firms will react. For users looking to do further research on the subject in more detail, they can visit a recently released website by the team at CPDOS. CPDoS variation - HTTP Header Oversize (HHO) from BleepingComputer.com on Vimeo. Did you enjoy reading this article? Kindly do like our page on Facebook and follow us on Twitter.](https://hackread.com/wp-content/uploads/2019/10/cache-poisoned-denial-of-service-cpdos-with-cdn.png)
