• Critical Vulnerability and Privacy LoopHole Found in RoboForm Password Manager

    Unless you are a human supercomputer, remembering password is not so easy, and that too if you have a different password for each site. But luckily...

  • miniLock - Open Source File Encryption Tool from CryptoCat Developer

    It’s the age of surveillance what made the Use of Encryption so widely that it has become a need of law enforcement agencies, cyber criminals as...

  • A BEGINNERS GUIDE TO HACKING UNIX

      *************  *       A BEGINNERS GUIDE TO:        *  *        ...

  • CASH! CASH! Hacking ATM Machines with Just a Text Message

    As we reported earlier, Microsoft will stop supporting the Windows XP operating system after 8th April, apparently 95% of the world’s 3 million...

  • Microsoft Word Zero-Day Vulnerability is being exploited in the Wild

    Microsoft warned about a zero-day vulnerability in Microsoft Word that is being actively exploited in targeted attacks and discovered by the...

  • Snoopy Drone Can Hack Your Smartphones

    The use of unmanned aerial vehicles (UAVS) called Drones is rapidly transforming the way we go to war. Drones were once used for...

  • Android Privilege Escalation Flaws leave Billions of Devices vulnerable to Malware Infection

    Android - a widely used Smartphone platform offered by Google is once again suspected to affect its users with malicious software that puts...

  • Introduction to Netcat

    Introduction : So I was messing around on the internet and came across a tool called Netcat.  I've been messing with it for a couple of...

  • Google Nexus phone vulnerable to SMS-based DOS attack

    Google’s Nexus Smartphones are vulnerable to SMS-based DOS attack, where an attacker can force it to restart, freeze, or lose network...

  • Linux worm targeting Routers, Set-top boxes and Security Cameras with PHP-CGI Vulnerability

    A Symantec researcher has discovered a new Linux worm, targeting machine-to-machine devices, and exploits a PHP vulnerability...

Saturday, 7 September 2013

Vulnerability allowed hacker to Delete any Facebook Photo; Rewarded with $12,500 for reporting bug

Indian Security Enthusiast 'Arul Kumar' recently reported an interesting Facebook vulnerability that allowed him to delete any Facebook image within a minute.


Facebook Bug Bounty program rewarded him with  $12,500 USD for helping the Facebook Security team to patch this critical loophole in their own "Support Dashboard".
The flaw is critical because using this exploitation method hacker can also delete Mark Zuckerberg's (Facebook Founder) Photos from his Photo Album, or even from wall of any verified page too.

Arul posted on his blog, "The Support Dashboard is a portal designed to help you track the progress of the reports you make to Facebook. From your Support Dashboard, you can see if your report has been reviewed by Facebook employees who assess reports 24 hours a day, seven days a week."

That means, if you will report abuse the targeted image and send a Photo Removal Request, Facebook Server Will automatically generates Photo removal Link and send to the Owner. If the Owner of that image clicks that link, Photo will be removed.


Hacker explained that two parameters i.e. Photo_id & Owners Profile_id are vulnerable and if hacker will change modifies the values of these parameters using Inspect Element feature of Google Chrome, then the hacker is able to receive that photo removal link to his own Inbox of another account, rather than sending to the owner's Inbox.

Video demonstration:
This way trick involves just two attackers Facebook account, no victim's interaction and hackers were able to delete any Shared-Tagged photos, Photo from Status & Photo album, Pages, Groups and also from Comments.

Recently Khalil, a Palestinian white hat hacker, Hacked into Zuck's Wall After Facebook Ignored His Bug Report.
Posted by at
Labels:

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)