:
Ok so it would seem that Facebook were fixing a technical issue regarding proxies, and nothing to do with security, according to the Scobleizer blog (which has some sort of access to Facebook’s PR team). Facebook is now alive again, and sporting some new hash values in the URLs - presumably unique to prevent proxy issues again…
I’ve seen a lot of links mention my employer in association with this post. I’d just like to reiterate that although I am employed by IBM, this is a personal, non-work related blog.
The postings on this site are my own and don’t necessarily represent IBM’s positions, strategies or opinions.
For more details about this and the IBM blogging guidelines, please read the About page.
Earlier on today I was getting some trouble connecting to Facebook’s login page - after trying to log in the connection just kept timing out instead of taking me to my home page like it usually does. Its pretty unusual for Facebook as its usually pretty reliable. But, these things do happen from time to time so I thought nothing of it.
A couple of hours later I came back to my computer after finishing up some work elsewhere and tried logging in again (I’m not addicted - I can stop any time I want…!). To my surprise my login details - usually stored and prefilled by Firefox - had gone and were replaced by an unfamiliar email address. I was certain that I had locked my computer before I left it (good habit to get into…), but it wasn’t beyond the realms of reality that I had forgotten and someone took the chance to log into Facebook. Unlikely - but certainly not impossible.
So I cleared the cookie and went back to Facebook again to log in. But now the Facebook page was showing me a completely different email address. A quick look in the source code and sure enough the email address was hard-coded into the tag’s value attribute! If I refreshed the page immediately I got my email again, but if I closed the browser and left it for a few minutes then went back - bingo! Another person’s email address had appeared! I wonder how many “live” email address got harvested today? I know I saw at least 5 or 6 and I was only looking for a few minutes…
So fast forward another couple of hours and I visit facebook again - now more out of curiosity than clinical addiction - and there is a notice up (click for larger version):
Pardon my paranoia, but is this not pretty odd? No prior warning, no adverts, no schedule, the source code has what looks like some frantically hand-coded HTML using and despite the XHTML doctype . Makes you wonder. What happened today Facebook?
Facebook is a social networking website
Popular social networking website Facebook went down for unknown upgrades, possibly to circumvent multiple holes that were published in a white paper earlier. From roughly 1:00 to 4:15 pm ET, users reported the site was down.

Blogs have speculated it may be simply a server upgrade, or it may be new features. One web development blogger has even raised the theory that the site was hacked, with the login box showing multiple random email addresses, through "" coding. Another user replied to this posting, saying that they were even able to read the other, random user's inbox. Both a blogger who works at a computing company's office in Johannesburg, South Africa and a Norwegian news outlet reported similar troubles. Many blogs received comments from people with similar circumstances, worldwide.

A white paper by Adrienne Felt, posted on July 27, 2007, explained step-by-step how to use an exploit to hijack a user's account. The white paper was then partially censored by the author, until the vulnerability has been fixed by Facebook. Regardless of whether the change was prompted by this paper, both the XSS hole and problem with forms described by the author were fixed during the upgrade.

The site read "We're upgrading. We'll be back soon." with no further explanation.

This is the first known global outage for the site.

This comes as a rival site, ConnectU, has filed a lawsuit against Facebook founder Mark Zuckerberg for allegedly stealing the idea and the code. The hearing is scheduled for tomorrow.

Also on Wednesday, the Black Hat Briefings computer security conference begins. The conference unites people from "government agencies and global corporations with the underground's most respected hackers."