A Scary Facebook Web Network Flaw

[cousinlucky]

My laugh of the day was provided by this AP news story:

My Way News - AP Exclusive: Network flaw causes scary Web error

[D-cat]

Yeah, that sounds like a gateway proxy error. My guess is the devices somehow got the same session ID and neither facebook nor the proxy had any way of knowing which phone which data was for. Instead of displaying an appropriate error, the proxy made an educated guess... and was wrong.

I have some more ideas to kick around, but I'm in McD with the PSP right now, so it'll wait 'till later.

[coopstah13]

it was a problem on AT&T's end, nothing to do with facebook, AT&T routed someone elses packets to a different device

[D-cat]

I know that. To facebook, it's no different than two people on different computers sharing the same access point. NAT's around the world successfully take care of this thousands of times a minute. The gateway router/proxy at fault would be that which belongs to AT&T; the server that a) routes the packets between the cell towers and the physical Internet connection and b) attempts to convert the pages in a way a phone can display them.

I'm trying to figure out how the device got confused in the first place. Could it be that phones have the same MAC address? Could the router simply not be configured/programmed/designed to handle the number of simultaneous users that were on at the time? Was it more a timing collision than a NAT packet parsing error?

I suppose we will never know the real answer beyond which AT&T officially releases, but to me is does make for an interesting hypothetical in Network Engineering to diagnose and solve.

[fguy64]

Yow! I suppose if it can happen with facebook, it could happen with other sites, such as email or online shopping accounts.

[D-cat]

Hmmm, interesting. I asked my daughter if she ever found herself mysteriously logged into someone else's account on facebook over the phone; she told me she had, some guy named Dave.

We're Sprint customers.

This may be a larger problem with common brand or even shared equipment.

@fguy64:
If it has to do with what I think it does, then yes, it could happen with any site that doesn't use encryption for normal communication. I think so far it's only facebook's popularity that has made it particularly noticed, but where the only complaints to date have been from mobile phone customers, it is still the routing hardware at or behind the telco. gateway that's most suspect.

I seem to remember once being returned a Google result that had nothing to do with what I searched for, but I blew it off and just hit back and searched again, all was good. Could be related to the same issue.

[cousinlucky]

Yesterday I found 7 yahoo emails from Facebook but I do not have a Facebook account. The first email was a welcome and it contained a link to cancel my email address from that account which is what I did!! I just deleted the rest of the emails!!

I wonder if someone at facebook did not like me starting this thread!!

[D-cat]

It was probably some other punk kid who had something to prove. I assume it was the e-mail addy posted on your web site? A lot of kids out there are fiercely addicted to facebook like sites and may have misread your post as an attack on facebook. I don't see it being anyone involved within facebook starting a forged account with the purpose of spamming your inbox; too much liability.

[cousinlucky]

Many moons ago, D-Cat, Yahoo had a promotion to its existing customers to add an email address to their existing account and both the primary and secondary accounts would appear in the inbox of the primary account.

The facebook email account was that secondary account of mine. It may be that yahoo failed to indicate that the account was already taken.

I will check that out now!!
Yahoo indicates that the account is not available!!

The contact account on my website is a my way email address. I do get spam once in a while there; but I am watchful of opening emails to that account from any strangers!