Scurgere de informaţie: Facebook arată adresele IP ale utilizatorilor săi.

Facebook are un sistem de notificare, care te informează prin e-mail despre diverse evenimente care par interesante pentru proprietarul contului facebook.
Acest sistem de notificare are unele neajunsuri, datorită lui se poate afla IP adresa persoanei care a generat evenimentul.
Drept exemplu mai jos prezint mesajul în totalitate cu toate header-ele a unui e-mail real de notificare, care l-am primit prin e-mail, despre faptul că Iulian Carauş a comentat la statutul Elenei Chiriac. Şi urmează să vă lămuresc, cum de utilizat e-mail-ul de notificare pentru a afla adresa IP a lui Iulian Carauş.

Acest cod se poate obţine la Yahoo! făcând click dreapta pe e-mail-ul de notificare şi selectînd View Full Headers.

Iată mesajul de notificare

From Facebook Fri Apr 23 09:34:42 2010
X-Apparently-To: xxxxxx@yahoo.com.com via 66.196.100.71; Fri, 23 Apr 2010 02:34:45 -0700
Return-Path:
X-YMailISG: dGjhDKIWLDu9QVi1c14isLhP7C8iXK73iPYQXgUxknmWm3LyvGPLEVWyNh6yweG6Ct6vj4vAGOHrUTsp3YWM4mDgA4awd4qCNpkoWSNrt5VR3I7ublEQ30GWEOLorTMRw7BxDL3ZXm57mbIvPWH0OIzZ3PiBHwxgWGk5MVMzUukl4V2ZbAFCNmCMaSQVpeWGXsJE1_pMAUu1yG645LrwCz2LQky5GJC0iII4WkrCSAojJE36_vtGvIkN0Imtm3eTuQkA8qq5UtLE_GHoTLI0TKyNKMJA8SdrSTLq5y3ADQ3GbcQzGXZogKg5Czs6xpWma0E4hYbE8q.Sl0mNHvc25ds_xqPnwfy1
X-Originating-IP: [69.63.178.160]
Authentication-Results: mta168.mail.sp2.yahoo.com  from=facebookmail.com; domainkeys=neutral (no sig);  from=facebookmail.com; dkim=pass (ok)
Received: from 127.0.0.1  (EHLO mx-out.facebook.com) (69.63.178.160)
  by mta168.mail.sp2.yahoo.com with SMTP; Fri, 23 Apr 2010 02:34:45 -0700
Return-Path:
DKIM-Signature: v=1; a=rsa-sha1; d=facebookmail.com; s=q1-2009b; c=relaxed/relaxed;
	q=dns/txt; i=@facebookmail.com; t=1272015282;
	h=From:Subject:Date:To:MIME-Version:Content-Type;
	bh=yUDs2pdX8QkFN535LZIS15z7cVQ=;
	b=SmYwxMj/zD4Hii0k4PeQB2kL+uyavwq40duVa9zzLfyPpIueDhlXnGC9bUU+sVB+
	vpPnOr3tUt1kVdK5Tz6vpg==;
Received: from [10.18.255.179] ([10.18.255.179:60801])
	by mta009.snc1.facebook.com (envelope-from )
	(ecelerity 2.2.2.45 r(34067)) with ECSTREAM
	id 31/B2-21312-2B961DB4; Fri, 23 Apr 2010 02:34:42 -0700
X-Facebook: from zuckmail ([OTQuMjQzLjEyMi4xMTA=])
	by www.facebook.com with HTTP (ZuckMail);
Date: Fri, 23 Apr 2010 02:34:42 -0700
To: Mihai Ursu
From: Facebook
Reply-to: Reply to Comment
Subject: Iulian Carauş commented on Elena Chiriac's status...
Message-ID:
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
X-Facebook-Notify: feed_comment_reply; from=xxxxxxxxxxxx; uid=xxxxxxxx; owner=xxxxxxxxxxx; oid=xxxxxxxxxxx; mailid=xxxxxxxxxxxxxx
X-Facebook-PseudoCamp: 1
Errors-To: noti...@facebookmail.com
X-FACEBOOK-PRIORITY: 0
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"
Content-Length: 783

Rîndul de care avem nevoie este: X-Facebook: from zuckmail ([OTQuMjQzLjEyMi4xMTA=])

Valoarea OTQuMjQzLjEyMi4xMTA= este adresa IP a persoanei (În acest caz – Iulian Carauş) care a generat evenimentul, codificată după algoritmul Base64.
Pentru a o decodifica, o copiem in cîmpul de mai jos şi apăsăm Butonul “decodifică”.

Special thanks and credits to Adrenalin for the idea of this post.

base64, e-mail, facebook, leak, Securitate Web, vulnerabilitate

This entry was posted on May 10, 2010, 00:56 and is filed under Curiozităţi. You can follow any responses to this entry through RSS 2.0. You can skip to the end and leave a response. Pinging is currently not allowed.

#1 by Radu Lisiţa on May 10, 2010 - 06:21

nu faceţi bug report? eu cred că ar trebui..

Quote

#2 by pimpo on May 10, 2010 - 14:30

buhaha, TOTI siteuri sa fac cash-ul din IP adrese a utilizatorii sai. noutate mare…

#3 by Mihai on May 10, 2010 - 14:36

Toţi fac cache, însa nu fac disponibile adresele IP publicului larg.
p.s. Ce are cache-ul cu asta?

#4 by so on May 13, 2010 - 16:00

E din start gresit, tocmai ca nu arata IP-urile, ca tu ai “spart” criptarea nu sunt ei de vina, ci tu..

#5 by Mihai on May 13, 2010 - 16:37

=))) sigur

#6 by oldschooladdict on July 6, 2010 - 15:38

solved .. now : X-Facebook: from zuckmail ([MTI3LjAuMC4x]) = 127.0.0.1

#7 by Maxim Macovei on February 9, 2011 - 02:29

Iaca eu nu stiam ca base64 e criptare

#8 by Mihai on October 17, 2011 - 14:08

@Maxim Macovei, eu nu am spus ca base64 e criptare =)

Securitatea Informaţiei