Facebook iPad

Facebook is coming to iPad! To try it out, login to http://touch.facebook.com

It should show this wide interface, its clearly been redone for iPad!

Drop a comment of what you think about this interface, will you use iPad for browsing Facebook?

UPDATE: Dammit it reverted back, there were new horizontal layouts a few minutes back! Was it a selected test?

I Will Hack Food - J0L1BU6 G0t H4X0R3D! (Jollibee got hacked)

I got home early today so I could attend the meeting tomorrow and as usual I got bored... and when I get bored something phun gets posted here. Hehe.

So I recently found out about this promo-game in Facebook called "Jollibee Sulit Sarap Challenge" wherein the top scorer for the week gets a P500 Gift Certificate from Jollibee (fastfood)... and it just hits me. I will hack for food! LOL

So I visited the application page and added it to my Facebook account then figured out the kung-fu behind it. As it turns out, its so bloody easy to hack -- less than a minute!

OK First of all this is just harmless fun, I did not break any security scheme doing this.

Now I feel like a lowly script kiddy for doing this and its LAME so I won't even bother to redeem my hacked fast food. LOL.

But seriously, the guys who pitched this to Jollibee clearly wasn't thinking straight.

Guys IF I were seriously going to P4wN you I could have made my score just always above the rest and not put 73337 as a score. So take this as a free advice and better pull that game out until you fix the boboo -- but better make its good because IF I get bored again, I will come back and play to see IF you have learned the kung-fu.

Neo: I know kung fu.
Morpheus: [eyeing him, hand on chin] Show me.

PEACE. HTH.

UPDATE 2/26 - 1:33 PM

I got an email from the devs:

FROM: Jay Anthony Chiu

Good morning Mr. Filomeno!

We've read about your blog about the Jollibee Hack (link: http://corruptedpartition.blogspot.com/2009/02/i-will-hack-food-j0l1bu6-g0t-h4x0r3d.html), and we appreciate your concern. We actually have seen this when we had our internal tester hack into it, and we are currently working on a resolution for this.

But for the meantime, I hope you would be able to put down your blog entry about this matter.

We hope for your cooperation.

Thanks!

Take it down? Seriously its too late, here is my reply:

Hi Jay,

Is teamyehey = Yehey!?

I didn't realize that and would have contacted you guys straight regarding the matter, i guess i was too sleepy at 4AM in the morning to dig more about it. I could take down the post but its aggregated to 2 dozen other splogs and bots out there and it wouldn't make a difference anymore by this time. As you guys work with SEO you do realize that when the source link is taken out the, aggregating site takes the highest authority on the subject thus updates (when you guys fixed it) to the original article wont be reciprocated anymore. Such that searches to "Jollibee Hack" would show the aggregating sites as top result and not the original post with updates with the fix .

Anyway I have made sure not to disclose the exploit vector on the post and only that its possible and its just easy for my level.

Finally, im sure it would only take 15-30 mins to fix the exploit vector, let me give you guys tips.

1. Never trust user input - hash the submitted data so that if tampered the hash will invalidate it. A hash with salt plus arbitrary padding data makes it almost impossible to figure out and crack the hash.

2. Use AMF - its a native Flash communication transport, by itself its not very effective but will protect the data from prying eyes like proxies.

3. Encrypt the entire data sent - SHA1 will be good enough and very simple to implement.

Did I make sense on the reply? What do you think guys? Will a take down really help fix it or just hide the fact that it has problems without giving users warning that the system is being gamed. Surely I'm not a hypocrite enough to say I'm the only one who can do this. Send feed backs on the comment and I'll decide later this day if take a down is necessary.

Finally, my hi-score has already been taken out from the database (thank God), but I do hope they really fix it soon coz I'm getting hungry :D

Stupidest application in Facebook: My College Friends

WARNING: This app poses as a Friend Invite, the name and description was crafted to confuse the user unless you check the application page.

See the screen shot I've annotated using FireShot, it explains everything.

TxtTayo! - A Facebook FREE SMS Messenger

First of all... It's been a long time since I announced a new service but it's not my fault! Blame it to my boss who wants to keep everything under wraps. Hehe. Anyway I have off the web-sphere for a long time for that matter and I want to celebrate my return with something new to offer, so here goes...

Introducing MegaMobile's TxtTayo FREE SMS Messenger for Facebook.

TxtTayo is is Facebook application on the web, it means you have to be a Facebook user to use this.

So what makes it different from Chikka or Sun iMessenger? TxtTayo allow you to send free SMS messages to your Facebook friends even if you don't know their phone number! Just think of the benefits using TxtTayo:

• Keep your number anonymous, never have to worry about stalkers again.
• Connect with friends abroad, let them send you messages from Facebook for free and you can reply back to straight from your phone.
• Share with friends, invite your friends on Facebook to use TxtTayo so they can send you SMS for free!
• Keep in control, allow only your true friends to send you messages not some fakester.
• No keywords to memorize, it works like your second phone number.
• No downloads required, most IM clients needs Internet anyway then why do you need to download it? Or why do you need another web site different from what you already use? Just login to your Facebook account!
• No connection problem, TxtTayo is powered by Facebook so we don't have connection problems and will work with firewalls with zero configuration.
• It's FREE, you're free to send via Facebook and Php2.50 to reply optionally via mobile for Globe and Smart. Php2.00 for Sun.

There you have it! Of course those are for regular folks, there are other ways to use TxtTayo. For example, you can create a Company Profile and let customers send you inquiries for free or send all of them updates of your new products for free!

Now are you excited to try TxtTayo? Click here to visit the TxtTayo Facebook application page to add it in your Facebook profile and start texting friends from free!

What's in the future? TxtTayo is going to evolve from being just an SMS messenger, as a matter of fact were evolving it beyond text messages and beyond anything that has been offered before. So watch out because "The Big Bad Godie is Back to Rock Your World!".