A serious flaw in Facebook that could have allowed widespread account hijacking has been uncovered by a UK researcher, who has been rewarded with $20,000.
The vulnerability, which has now been fixed, was a particularly nasty one and easy to exploit. It allowed for a “full takeover of any Facebook account, with no user interaction”, researcher Jack Whitton, also known as fin1te, wrote in their blog.
When Whitton texted Facebook with a simple “F” to get the verification code needed to get the mobile login feature, he was asked to enter that code into a form. But that form contained a flaw, which allowed him to change the profile_id parameter so he could link any user with his authorisation code, therefore opening accounts up for hijacking.
“To exploit this bug, we first send the letter F to 32665, which is Facebook’s SMS shortcode in the UK. We receive an 8 character verification code back,” he explained in a blog post.
“We enter this code into the activation box (located here), and modify the profile_id element inside the fbMobileConfirmationForm form.”
Once Facebook sent back an SMS confirming the code had been linked to an account, Whitton realised he could initiate a password reset to hijack the target’s account.
“The bounty assigned to this bug was $20,000, clearly demonstrating the severity of the issue,” he added.
The news came just days after Facebook admitted another flaw had leaked around six million users’ contact information and an unconfirmed number of non-Facebook users.
What do you know about Internet security? Find out with our quiz!
Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…
Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…
Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…
Welcome to Silicon In Focus Podcast: Tech in 2025! Join Steven Webb, UK Chief Technology…
European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…
San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…