A serious flaw in Facebook that could have allowed widespread account hijacking has been uncovered by a UK researcher, who has been rewarded with $20,000.
The vulnerability, which has now been fixed, was a particularly nasty one and easy to exploit. It allowed for a “full takeover of any Facebook account, with no user interaction”, researcher Jack Whitton, also known as fin1te, wrote in their blog.
When Whitton texted Facebook with a simple “F” to get the verification code needed to get the mobile login feature, he was asked to enter that code into a form. But that form contained a flaw, which allowed him to change the profile_id parameter so he could link any user with his authorisation code, therefore opening accounts up for hijacking.
“To exploit this bug, we first send the letter F to 32665, which is Facebook’s SMS shortcode in the UK. We receive an 8 character verification code back,” he explained in a blog post.
“We enter this code into the activation box (located here), and modify the profile_id element inside the fbMobileConfirmationForm form.”
Once Facebook sent back an SMS confirming the code had been linked to an account, Whitton realised he could initiate a password reset to hijack the target’s account.
“The bounty assigned to this bug was $20,000, clearly demonstrating the severity of the issue,” he added.
The news came just days after Facebook admitted another flaw had leaked around six million users’ contact information and an unconfirmed number of non-Facebook users.
What do you know about Internet security? Find out with our quiz!
Tesla retreats from pioneering gigacasting manufacturing process, amid cost cutting and challenges at EV giant
No skynet please. After the US, UK and France pledge human only control of nuclear…
Microsoft's AI investments continue in south east Asia, after investments in Japan, Malaysia, Indonesia, as…
New chapter for LastPass as it becomes an independent company to focus on cybersecurity, after…
US FCC seeks to ban Chinese telecom firms at centre of national security concerns from…
Two updates to Anthropic's AI chatbot Claude sees arrival of a new business-focused plan, as…