A serious flaw in Facebook that could have allowed widespread account hijacking has been uncovered by a UK researcher, who has been rewarded with $20,000.
The vulnerability, which has now been fixed, was a particularly nasty one and easy to exploit. It allowed for a “full takeover of any Facebook account, with no user interaction”, researcher Jack Whitton, also known as fin1te, wrote in their blog.
When Whitton texted Facebook with a simple “F” to get the verification code needed to get the mobile login feature, he was asked to enter that code into a form. But that form contained a flaw, which allowed him to change the profile_id parameter so he could link any user with his authorisation code, therefore opening accounts up for hijacking.
“To exploit this bug, we first send the letter F to 32665, which is Facebook’s SMS shortcode in the UK. We receive an 8 character verification code back,” he explained in a blog post.
“We enter this code into the activation box (located here), and modify the profile_id element inside the fbMobileConfirmationForm form.”
Once Facebook sent back an SMS confirming the code had been linked to an account, Whitton realised he could initiate a password reset to hijack the target’s account.
“The bounty assigned to this bug was $20,000, clearly demonstrating the severity of the issue,” he added.
The news came just days after Facebook admitted another flaw had leaked around six million users’ contact information and an unconfirmed number of non-Facebook users.
What do you know about Internet security? Find out with our quiz!
For third time Google delays phase-out of third-party Chrome cookies after pushback from industry and…
Elon Musk firm touts cheaper EV models, as profits slump over 50 percent in the…
Bad news for Tim Cook, as Counterpoint records 19 percent fall in iPhone sales in…
TikTok pledges to challenge 'unconstitutional' US ban in the courts, after President Joe Biden signs…
British regulator invites feedback on major partnerships Microsoft and Amazon have struck with smaller AI…
Another 20 staff have been fired by Google over Israel protest and their “completely unacceptable…