Showing posts with label facebook. Show all posts
Showing posts with label facebook. Show all posts

Monday, November 2, 2009

Going Technical (not that much)

There's always a siren singing you to shipwreck
Radiohead


As the title suggests, this (pretty verbose) post is for anyone interested in what my work will roughly consist of. For those who do not master things like graph theory and routing protocols, it may still be interesting to read the example below, or to look at the bottom of this post for a colorful example.

The first step of my thesis concerns the enhancement of BGPlay, an application developed by the CompuNet Research Group at Roma Tre University and currently hosted by Oregon Route Views. It shows animated graphs with edges (peerings) connecting nodes (Autonomous Systems), therefore allowing an intuitive analysis of interdomain routing events related to a specified prefix, within a time interval. My contribution will be to adapt BGPlay's interface to the INRDB, a prototypical database realized by the Science Group at the RIPE NCC, containing historical data gathered from many authoritative sources. The aim is to provide an instrument for a long-term, coarse-grained analysis of major trends and events affecting the Internet throughout its (relatively) long history.

In plain words? Alice wastes hours on Facebook playing FarmVille. Her CowComputer unwillingly converts every passionate click into a Mooossage, sending it to some FarmerComputer somewhere. Before reaching the FarmerComputer, every message goes through many welcoming TransitFarms. If a FlockOfDumbSheep proudly blocks the path, the Mooossage is incredibly smart enough to find another way visiting different TransitFarms, without letting Alice notice any difference. If however a MadFarmer puts some misleading road signs on the way to the FarmerComputer, or if some NastyChickens tear down all the bridges to cross over the unfailing river, the Mooossage is only able to commit a honorific suicide. Well, in both cases BGPlay acts as the black box secretly hidden under the Mooossage's skin, allowing Alice to understand what led it to such an extreme action.

If you are still awake, here's a video showing a real case study: the Youtube prefix hijacking by Pakistan Telecom in February 2008. It was realized using the previous version of BGPlay, already hosted by the RIPE NCC for some time. Enjoy!

Monday, March 16, 2009

Photo privacy on Facebook

'Cause fashion can't replace content
Raein

The exam session is finally over! Spare time is synonymous with violent gigs, devastating parties, and even with a brand new post about the social network we all treat as a brother.

As reported in these blogs, Facebook photos have been considered far from private since the beginning. The reason is clear: Facebook relies on a small number of Content Delivery Networks to host static contents (photos, videos, css, js...), so there's no check for the identity of the client. This means that everyone is able to see a photo, given a direct link to it.

Recently (and silently) something has changed. This is an old set of contiguous photo URLs from the same album:
http://photos-a.ak.fbcdn.net/[...]/1039372716/n1039372716_266356_3811.jpg
http://photos-b.ak.fbcdn.net/[...]/1039372716/n1039372716_266357_4117.jpg
http://photos-c.ak.fbcdn.net/[...]/1039372716/n1039372716_266358_4397.jpg
http://photos-d.ak.fbcdn.net/[...]/1039372716/n1039372716_266359_4698.jpg
http://photos-e.ak.fbcdn.net/[...]/1039372716/n1039372716_266360_4992.jpg
[...]
http://[serverName]/[(pseudo)directories]/[userID]/[size][userID]_[photoID]_[PIN].jpg

And here's a new one:
http://photos-a.ak.fbcdn.net/[...]/2649_1096706251415_1039372716_300200_1526354_n.jpg
http://photos-b.ak.fbcdn.net/[...]/2649_1096706291416_1039372716_300201_1765863_n.jpg
http://photos-c.ak.fbcdn.net/[...]/2649_1096706331417_1039372716_300202_7597791_n.jpg
http://photos-d.ak.fbcdn.net/[...]/2649_1096706371418_1039372716_300203_1393878_n.jpg
http://photos-e.ak.fbcdn.net/[...]/2649_1096706411419_1039372716_300204_4965159_n.jpg
[...]
http://[serverName]/[(pseudo)directories]/[firstID]_[albumID]_[userID]_[photoID]_[PIN]_[size].jpg

Can you spot a couple of differences?
1)the new albumID comes with some weird math, yet simple to be understood (and bypassed);
2)the PIN is now longer and, even worse, it seems to come from a random (or at least unidirectional) function. That can be demonstrated uploading small photos (just 1x1 pixels!) and staring at the relative PINs, with no chance to understand them. Obviously it is still possible to guess some PINs adopting a brute force approach, but too much time is needed to achieve some nice results.

Thumbs up for Facebook? Not yet.
So keep that photo from being replicated on hundreds of servers around the world...

 
(Raein. photo by A bout de Souffle Art)