Platform Integrity: Lessons Learned in Protecting the Facebook Platform
summary
Facebook reports hundreds or thousands of malicious apps every day and defends by logging every app event, aggregating time-window counters in a real-time stream, then applying rules and machine learning to flag bad apps. Enforcement uses soft disable with an appeals flow and a developer-level reputation classifier plus phone verification to raise attacker costs. Social-plugin clickjacking is blocked by a confirmation dialog that pops into a separate window, and OAuth session theft is detected by aggregating app ID, IPs and redirect URIs and by banning malicious URLs.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:43Malicious App Anatomy
- 3:40App Enforcement System
- 7:33App Enforcement Experience
- 8:34Developer Level Enforcement
- 10:25Economic Friction Strategy
- 12:28Clickjacking Attacks
- 15:06Preventing Clickjacking
- 17:33Session Theft Mechanism
- 20:38Fighting Session Theft
- 24:20Lessons Learned
- 26:13Q&A and Conclusion
related talks
17mDesigning security and safety for billions
55mFacebook's Approach To Common Web Vulnerabilities
37mOutsmarting Hackers before your App gets pwn'ed
33mHacking and protection of Mobile Apps and backend APIs
46mFacebook Malware: Tag Me If You Can
44mScams, Malware and Pseudo-Moderation — the Hidden Side of Social Media
40mBest practices for shielding mobile apps from emerging threats
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security