Facebook disables some legitimate apps while targeting malicious ones

The use of tools to detect malicious patterns in apps led Facebook to temporarily disable some legitimate third-party apps that integrate with the social networking website, it said Thursday.

On Tuesday, a number of people complained that their Facebook developer accounts and apps were unavailable.

Facebook said it uses automated systems to identify and disable malicious apps, so as to protect its platform and users. These techniques identify a malicious pattern, find the apps that match that pattern, and then disable those apps.

"This normally results in thousands of malicious apps being disabled and improves our automated systems' ability to detect similar attacks in the future," Facebook employee Eugene Zarakhovsky wrote in a blog post.

But on Tuesday, Facebook started with a broad pattern that correctly matched many thousands of malicious apps but also matched many high-quality apps.

"When we detected this error, we immediately stopped the process and began work to restore access," Zarakhovsky wrote. "The process took longer than expected because of the number of apps affected and bugs related to the restoration of app metadata."



Facebook did not say how many legitimate apps were affected.

The company now plans to make improvements to its processes and technology, including better tools to identify overly broad patterns and better processes to verify that all the apps matched are in fact malicious. It will also address the bugs and bottlenecks that slowed down the recovery process.

Facebook has been unveiling tools to get developers to integrate their apps with its platform. In April it announced plans to acquire Parse, a cloud-based platform that provides cross-platform services and tools for developers. "By making Parse a part of Facebook Platform, we want to enable developers to rapidly build apps that span mobile platforms and devices," it said at the time.

Patch Tuesday: Malicious fonts bedevil Microsoft Windows

Of the six critical security bulletins Microsoft issued in its Patch Tuesday monthly release of software updates, three address a vulnerability in how Microsoft software renders fonts.

"Fonts have become really complicated," said Wolfgang Kandek, chief technology officer for compliance and security software company Qualys. "There is real processing going on when you print a character, and that complexity can be attacked."

The number of critical bulletins Microsoft released this month is a bit higher than normal, Kandek said. Typically, Microsoft will issue about two or three critical bulletins on Patch Tuesday, which occurs on the second Tuesday of each month. This month half the bulletins -- MS13-052, MS13-053 and MS13-054 -- address how Microsoft systems handle the rendering of TrueType fonts.

With this vulnerability, an attacker can embed malicious values in a font description that would overrun the memory allocated to the font-drawing routine, and write into sections of memory reserved for other operations. The font instructions could be provided to Windows or Internet Explorer (IE) by way of a Web page or a document.

"Depending on where this happens, this can be quite serious," Kandek said.

Windows, for instance, renders all characters onto the screen as a system user, not as a standard user, which has fewer system privileges. An exploit of a font-rendering vulnerability could "go right into the operating system and take control at that level," Kandek said.

Overall, Microsoft issued six critical bulletins, covering Windows OS, the .NET Framework, Silverlight, Office, Visual Studio, Lync and IE. A seventh bulletin, labeled as important, covers the Windows Defender security software.

All six of the critical bulletins include remote code execution vulnerabilities, which can be used to provide attackers with illicit access to machines.

Seventeen of the 34 vulnerabilities covered in the bulletins address IE. "Researchers continue to find flaws in IE, and the attack surface is pretty big," Kandek said, referring to how Microsoft is now supporting five different versions of the browser. The vulnerabilities affect IE versions six through 10 that run on Windows XP, Windows Vista, Windows 7, Windows 8, Windows Server 2003, Windows Server 2008 and Windows RT.

"The major problem there is that users or companies still maintain old versions of the browser. We would be better off if everyone was on the newer version" of IE, Kandek said.

One Windows vulnerability, which affects memory management, has already been publicly revealed, and has been used for an exploit that can run on the Metasploit penetration testing software. Security researchers are urging administrators to update their own versions of Windows XP, Windows Vista, Windows 7, Windows 8 and Windows 2008, Windows 2012 and Windows RT as soon as possible.

"July is one of the uglier releases we've seen from Microsoft this year. To say that all Microsoft products are affected and everything is affected critically is not an overstatement," wrote Lumension security and forensic analyst Paul Henry in an email statement. "It's difficult to prioritize one or two because all the bulletins likely need your attention this Patch Tuesday."

In addition to Microsoft patches, administrators should also take a look at Adobe's monthly set of patches, also released Tuesday. They cover vulnerabilities in Adobe Flash, Shockwave and ColdFusion, which is server-side software for rendering websites.

Follow me on Twitter @sajilpl