Maximum PC photo RSS Feed

The Tip of the Facebook Exploit Iceberg

David Murphy — Thu, 27 Mar 2008 14:42:00 -0500

Who's Byron Ng? A total tool, that's who. He's the one who ran a few Google searches and tipped off the Associated Press about a Facebook exploit that's been passing around the 'net for months now. The AP picked up the story and put it in every newspaper under the sun, making him a minor campus celebrity who's now forever disinvited to Facebook Club. It also tippped off Facebook to what was going on, and the company was quick to plug the exploit.

Thanks a lot, man.

But for all the press I've been seeing about this crazy hack that's destroying the privacy of millions--by letting everyone in the world peer into the secret debauchery of important facebook users like Paris Hilton--I haven't seen a single news story that actually tells you what happened. Or how to even go about "exploiting" Facebook's security issues. For starters, the trick was a lot easier than you might think, requiring very little effort on the "hacking" end of things and a decent amount of know-how on the "ingenuity" side of the equation.

The Setup

First, you had to find the ID number of your target. Facebook assigns each user an individual ID number, perhaps a mistake on the service's part. When you're viewing your own profile, this is the huge string of numerals that comes after the "profile.php?id=" part of the URL. Same deal when you're viewing a friend's profile.

So how, then, do you acquire the ID number of a person who isn't your friend? If they haven't privacy-blocked your ability to see their profile, it's as easy as looking them up using a simple Facebook search and clicking through to the profile. Check the URL, and you'll find the ID number.

If your target has privacy-locked their page, the situation gets a little more complicated. In Paris Hilton's case, she's made it so you can only send her a message if you aren't her friend. But in that, you can pull the ID number. Check out the URL Facebook generates for Ms. Hilton's "send message" link. I'll underline her ID number:

http://www.facebook.com/search_redirect.php?q=paris,hilton&fc=0&gc=3613
&cl=300&rc=4073&rank=4&friends=0&sns=0&k=400000000010&t=1&u=
http://www.facebook.com/inbox/?compose&id=1118869250&k=400000000010

See? As long as Facebook allows you to interact with a person in some capacity, you can pull their ID number. This even works for people who have blocked you off the service, just as long as you've retained some level of correspondence--say, a Facebook message (use Facebook's Report Message link to pull the ID on this one).

Keep this little trick in mind, because when the next Facebook exploit hits, it'll surely make use of the service's ID numbers as the basis for the hack. In fact, you can already use ID numbers on Facebook applications to see things you shouldn't--for example, any Free Gifts (and accompanying messages) a person has sent to or received from anyone else using the application, regardless if you're friends (or blocking) the original target. Use one of these URLs:

http://apps.facebook.com/freegifts/?to=[[ID NUMBER]]
http://apps.facebook.com/freegifts/?from=[[ID NUMBER]]

The Hammer

Once you had the Facebook ID number, the exploit itself was easy enough to navigate. Facebook used to delineate the URLs for photographs as such:

http://www.facebook.com/photo.php?pid=[[THE PICTURE'S ID]]
&op=1&view=all&subj=[[ID NUMBER OF SOMEONE TAGGED IN THE PHOTO]]
&id=[[ID NUMBER OF ALBUM'S OWNER]]

The bracketed portions are the parts that change depending on what you're looking at. The Picture ID is the number Facebook assigns, sequentially, to images uploaded to its service. The subj= ID number is, as the description suggests, the ID number of a person tagged in the particular photo. And the ID number of the album's owner, well... we'll just leave it at that.

Normally, when you click on a "show me more pictures from x" user link, it would look like this: the picture ID would be unique, the subj= part would be the person's ID, and the ID number of the album's owner would populate that field. The Facebook exploit worked as follows: you'd start by entering a random nine-digit number for the picture ID section. You'd use your target's ID number for the "someone tagged in the photo" part, and reuse that same ID for the album's owner section.

This little trick never got you results on the first shot, but that's ok; the point of the URL manipulation was to acquire a correct photo ID. In this case, Facebook would return you an error message saying that the page could not be found, but it would also autocorrect the pid= part to reflect the photograph the target was last tagged in. From there, you'd take the given URL and delete the entire &id= portion, leaving just &subj=####### as the end of the URL. Hit enter, and voila! Instant access to the last photograph the target was tagged in, and access to the entire album of pictures from which that one image resides, whether you're the friend of the individual who created it or not.

An error? Hardly. Seeing this screen meant you were but one step away from private pictures galore!

A similar trick worked to access the last photo the target tagged of him/herself. These tricks didn't exactly break the dam of Facebook privacy, but it did give industrious users--and stalkers--a means to check up on what anyone's doing at any time, only dependant on one's tenacity and zest for URL refreshing. But thanks to Byron, who clearly felt the need to let the world that He and He alone found this industrious exploit, we will no longer be able to catch up on what our favorite internet celebrities are up to. Sigh.

You, sir, owe the Web 2.0 an apology.

Hey!

We've done some more research and found a few more facebook exploits! Hi to all the Digg users who are keeping up with this!

I just sent Paris Hilton a beer.

Anonymously, of course. We're not even friends. I can't see her profile. But the hotel heiress now has a Guinness courtesy of yours truly, just one more example of how certain Facebook applications can be broken with a little ingenuity. Sending Free Gifts to anyone using the application is a fun way to screw with your friends, but it's only the tip of the exploit iceberg that Facebook's applications have opened up. Here's how it works:

First, you need to grab a fun little Firefox extension called Firebug. It opens up web pages to tweaking in a variety of fun, form-intensive methods. Install the Free Gifts application on Facebook and surf on over to the sending page. Select a gift, click Anonymous, and enter the name of one of your friends in the To: field. In two separate windows, surf to Facebook yet again and pull up your friend's profile, as well as some means for finding your target's ID number (as detailed earlier). Remember your friend's Facebook ID number, and surf on back to the Free Gifts sending page.

Right-click on the Send Gift button and click Inspect Element. Then click on the Dom tab at the top of Firebug's little window. Scroll down--you're looking for the To: field. When you find it, you'll see an number. Guess what? That's the Facebook ID number of the person you entered in the To: field! Click on the number and Firebug will open up a large list of other options. Scroll down until you've found the "Value" field--it should be right below the "Type: Hidden" option. Double-click on the ID number and enter the target's Facebook ID in quotes. Hit Enter, then turn your attention to the Free Gifts sending page and hit Send Gift. Blam. One anonymous gift to someone who isn't your friend / has blocked you / whatever.

You'll go blind trying to find it, but your key to Free Gift sending is that little To field that pushes out your recipient's Facebook ID. Replace it with a new target and fire away!

That's just the tip of the iceberg, as I mentioned earlier. The Consumerist has a nice little write-up on other potential exploits, including one that allows you to set the Mood of your friends for them! That said, 2600 ran this information in their Winter Issue, so check that out for even more details! Or just surf on over to one of the original sources of the exploits, the defunct Facebook Application Smashing blog.

While Facebook itself--the service's core functions--are relatively exploit-free, mark my words: these applications will open up a world of open doors for industrious Facebook tricksters. We'll update as we find more fun things to do!

Better Photo Transfers for Windows Vista

Mark Soper — Mon, 21 May 2007 15:53:56 -0500

I really like using the Scanner and Camera Wizard (SCW) in Windows XP (and yes, it was originally developed for Windows Me!). SCW makes organizing digital photos easy, because you can select the pictures you want to transfer from your camera or flash memory card reader, name them, and copy them to a folder of your choice (by default, the name you assign to the picture group).

Unfortunately, SCW just hasn't kept up with the times. When you use it to transfer large pictures (5MP and higher), it's painfully slow to display the thumbnail images you use to select the photos you want to transfer. Thus, it's not surprising that SCW's been replaced in Windows Vista.

Even worse, its Vista replacement, the Importing Pictures and Videos wizard, is an annoying case of "one step forward, two steps backward."

What's good: optional picture tagging during transfer; automatically rotating pictures during transfer; displaying pictures in the Windows Photo Gallery (one of my favorite new Vista features); picture transfer from USB thumb drives.

What's bad: no way to select only certain photos for transfer; slow transfer times.

I know the list of good features is longer than the list of bad features, but trust me: if you use a digital camera, you want more control over image storage and naming than Importing Pictures and Videos gives you.

Free, Fast, and Fun – Picasa2

If you're a bargain-hunter (how does "free" sound?), try Google's Picasa2. Picasa2 displays the photos on your media (including USB flash drives) in a hurry and lets you select the pictures you want to transfer. During the 'blink-and-you'll-miss-it' transfer process, Picasa can name the pictures, the destination folder and add caption and location information you specify.

Power at a (Low) Price – Adobe Photoshop Elements' Photo Downloader

For more control over the transfer process, use the Photo Downloader in Adobe Photoshop Elements 5. The basic transfer process (which also works with USB flash drives) is comparable to Vista's Importing Pictures and Videos wizard, but it's faster. However, open the Advanced Dialog and you can specify author, copyright, file and folder name, add a tag, automatically fix red-eye, and (as with SCW and Picasa) you can select the photos you want to transfer.

If you prefer other photo editing programs, check the feature list for file transfer programs you can use instead of Importing Pictures and Videos.

SyncToy – Fast File Transfers for Purists

If you'd rather transfer your pictures now (fast!) and organize them later, don't overlook Microsoft's free SyncToy (starting with version 1.4, it works with 32-bit Vista editions as well as Windows XP). SyncToy lets you set up your choice of five different synchronization settings between any two folders on your system. Because any particular digital camera uses a consistent folder naming scheme, you can use SyncToy with your digital camera (if it is assigned a disk drive letter by Vista), with your camera's removable flash memory inserted into a card reader, or with USB flash drives. You can't rename your pictures or tag them, but for speed and the ability to preview what happens to your files, it's hard to beat SyncToy.

So, if you're grinding your teeth waiting for Importing Pictures and Videos to work its way through your digital pix, don't settle for it: you have better choices, and some of them are free!

Photo Finale

Gordon Mah Ung — Fri, 01 Dec 2006 02:53:18 -0600

Remember when your high school counselor asked you about your life goals? Remember when you told her that you just wanted to finish high school? Remember when she sighed and told you to set your goals a little higher? The folks at Trevoli should do the same thing with Photo Finale.

Photo Finale should compete with the digital-imaging set—you know, Firegraphic and Photoshop Album—but it seems to only aspire to smoking weed, hanging with the fellas behind the 7-Eleven, and grooving to the new AC/DC album. Maybe, just maybe, it will one day be accepted alongside photo-management apps that are given away for free.

Photo Finale just feels uninspired to us—almost listless. Sure, Trevoli pushes it as an “easy” way to get photos from your camera, organize them, and even make CD or DVD slide shows from your pics. But most digicams come bundled with software that handles those simple tasks. And Photo Finale’s image-tweaking features are along the lines of cropping and red-eye removal—nothing more complex than that. The slide show titling tool is so frustrating to use that we want to expunge the software from our system permanently, and the limited clip art selection seems like it was lifted from a CD-ROM circa 1995.

To be fair to Photo Finale, plenty of other programs are technically in this slacker category, including Google’s Picasa. But Picasa is free. And Picasa is at least able to process RAW photo files, something you can’t do with Photo Finale.

Not everything about the app is negative. We actually like Photo Finale’s ability to sort photos by the camera’s exposure setting—if nothing you’ve shot looks sharp, it probably means your technique is weak.

But this does little to chip away at Photo Finale’s flaws—the biggest of which is its lackluster performance. On a dual-core Athlon 64 FX-60 with 2GB of RAM and a 400GB hard drive, the app just chugs. The program takes roughly two seconds to move from image to image. XP does the same thing in half a second. Indeed, there are just too many negatives in Photo Finale’s column to recommend it.

Month Reviewed: November 2006
Verdict: 3
URL: www.trevoli.com

Picture Code Noise Ninja

Gordon Mah Ung — Fri, 17 Mar 2006 15:35:16 -0600

As camera makers have shoved more and more pixels onto tiny imaging sensors, digital pictures have become increasingly noisy and so filled with grain that the old craptacular Disc Camera seems superior at times.

Enter PictureCode’s Noise Ninja, an application that takes a +3 katana to the digital noise that can ruin an otherwise good picture. Ninja comes in a dizzying array of flavors but we looked at the stand-alone professional version (a plug-in for Photoshop is also available). The pro version supports 16-bit images, batch processing, and multi-threading.

We tasked Ninja with cleaning up a couple of grainy images from our own collection, one of which was a candlelit JPEG image taken with a Canon 5D at 3200 ISO. (While the 5D’s full-frame sensor is more than capable of producing clean, sharp pictures, a candlelit shot at 3200 ISO is a challenge for any digital camera.) To compare the Ninja’s performance, we also ran our images through Adobe Photoshop CS2’s built-in noise-reduction filter. There was no contest. CS2’s “free” functionality doesn’t hold a candle to Ninja’s noise reduction, or speed. Furthermore, Ninja is aided by prebuilt profiles that are available for a host of digital cameras models.

What really impressed us was the program’s efficiency. Tweaking an image often requires a lot of back and forth, as you “clean” areas, then revert back to the original, turn a few knobs, and clean again. With other products, it can get pretty tedious because of the slow pace at which the changes are processed. We had no complaints about speed with Ninja. Even on a single-core 3.8GHz Prescott Pentium 4, the performance was snappy. What’s more, Ninja is multithreaded, so users with dual-core PCs and PCs with Hyper-Threading should see an even greater boost in speed. We applaud developers who support today’s hardware instead of pandering to the unwashed masses of ancient Pentium IIIs.

Ninja isn’t just about the hardware support though; its snappy performance, ease of use, and batch processing make it a must-have for anyone who is serious about his or her digital pictures.

Month Reviewed: April 2006

Verdict: 9
kickass=yes

URL: www.picturecode.com