Facebook Connect Exposes Hulu User Data 60
An anonymous reader writes "Over the weekend, Hulu rolled out Facebook Connect integration. Almost immediately after launch, Hulu had to pull the feature as the company discovered a technical issue affecting a limited number of users. More specifically, some users weren't seeing their own Hulu account information upon login, but someone else's."
Hulu's problem (Score:5, Interesting)
The company has admitted that the flaw was the result of a coding and configuration error on Hulu’s side. The company has denied that the issue is the result of hacking, other third party actions, or a vulnerability in Facebook Connect.
Re:Ahh that old bug (Score:5, Interesting)
I had a friend who had a problem just like that. What had happened in that case was this... Each user was given a session cookie, using functionality included with the language (an older version of ColdFusion). The cookies were a pseudo random number. It was all fine and dandy with just a few users on, there was very little chance of collision.
When it was introduced to the real world, you didn't just have one or two people on, you had thousands of simultaneous users. Beyond that, the sessions had a relatively long TTL (a few hours, if I remember right).
Well, User A logs in, does their stuff, and then leaves. No problem. They could have even hit the logout button, but CF didn't properly ditch the session. When User X (someone down the line) came in, they were issued the *same* session cookie. It didn't validate anything. It didn't care what your IP, username, or anything were. So when they reached part of the site dependent on the session cookies, their credentials tied in with User A's session, not theirs.
Needless to say, the users were not entertained.
Beyond that, I demonstrated that with a little bit of cookie manipulation, you could access any account that was recently active. I did it with just changing a few things to arbitrary values, and accessed someone else's account. I then had *them* go to the site and log in. They then read me off their cookie information, and I modified my cookie to match. Voila, I'm them.
They weren't very happy. There was a period of about 10 minutes, where there was some colorful language used. They finally went to work writing their own cookie routine, so they wouldn't have the risk of these collisions any more.
With the load that Facebook can throw at a site, I'm sure there's a huge risk of collisions. Not ever user would have the luxury, but enough would to make it an issue. Someone should have seen it coming and dealt with it, but obviously it wasn't handled properly.