Re: [tor-talk] Facebook brute forcing hidden services

[Colin Mahns <colinmahns@xxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hey Alec,

I'm one of the developers on darkweb-everywhere. I was playing around
with having fbcdn.net redirect to
fbcdn23dssr3jqnq.onion with a rule, hoping to cover instances where
people have linked directly to images from Facebook.

Since the cert Facebook is using doesn't have a wildcard subdomain for
the hidden services, the user is presented with a mismatched exception
error. Obviously this isn't intended so I figured I would reach out to
you about this :)

Here is the example I used [0][1] I included both the original link
and the redirected one. This was found by searching for site:fbcdn.net
on Reddit and picking the first non-broken safe for work image I could
find (this was surprisingly hard!).

I'm not too familiar with how Facebook handles these links, or if this
is even expected behavior. It seems the fix should just be reissuing
the cert with a wildcard flag, but I could be wrong. Any ideas?

I'm cc'ing tor-talk on this email since I figured more users reading
this can't be a bad thing.

[0]:
https://scontent-b-iad.xx.fbcdn.net/hphotos-prn2/t1/1896752_807594532587586_979724882_n.jpg
[1]:
https://scontent-b-iad.xx.fbcdn23dssr3jqnq.onion/hphotos-prn2/t1/1896752_807594532587586_979724882_n.jpg

Colin Mahns
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJUVSw5AAoJEPKk/ZeJv4OMa5AP/16XtoE5I8Sl5OylDd0pyzWn
QHz+7D1idEKOSjIq8ufdHCiFyxsJO5sDHWdxVI1sDuo98YNlYYtNkmkHnKdqT2rl
QW1DJzK8QUxVxRPwtbXdvwRHlKlkW3TSAHQztKoci4x+2JAy2bR5tcUi9mE1KBwj
5UQoK8ZsF7OXFla22iiDVAz2GQyFRUZ0B7AsLjFp+YZz2oPuAvpISsGnDdgAO08E
QeJNdAZnCTzww6LJffrBcVMu10sLvesGrPSqDYMUIFQ6fwCDSU6D1Y1eTs8FtEIl
pRd/PHTZuNnUhNA3sJJQ7v3FF0FXfLHX13uf6elpL3ySOX/2ynTrWop5GFBjNXSa
wrp+nbVVw3hd1NZZufUcSDx+3h3ltzGaFmN/OXPN4+KzIIOUjGovCWGaVPOSpbMv
H44DQZzGaoTaJJO5KzW0xvRGuPLUMbRJjgLR+/FDE3iqfk7g8j4ipVa0mDlZATZP
p7fJbDcNzgjwzvZ1f+eva3515X/1A4oAx5UOaJIj0dzv65QtpFVlia8Cm2Vi8R3g
oC35XRkkcQpcx0nVFW9RcnZ/MGyPhXRJIoVV0vr+kZgChiQWmzc5K+2guU6Nke1d
UFt1AoQUatVrZ6QAmzIDnjul7lTkpJa3Wkj0pxqlbw7iKzpgJXn+znPflxnsS/aV
u9L6TycslYy5AxaOfa0f
=boAs
-----END PGP SIGNATURE-----
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk