Facebook fixes flaw that could have let hackers delete photos

Facebook paid an outside developer $12,500 for discovering the flaw

facebook messenger

Facebook quickly fixed a flaw that would have allowed hackers to delete users' photos.

Credit: Facebook

The speed at which Facebook responded to a reported security vulnerability shows how important photos have become to the site.

The vulnerability could have allowed hackers to delete photos. An outside developer discovered the vulnerability in Facebook's Graph API, the primary way for outside developers to build apps and software that tap into Facebook's data.

The developer, identifying himself as Laxman Muthiyah in a blog post published Thursday, said he was able to use a mobile access token for the API to delete photo albums that were not his.

He alerted Facebook to the vulnerability and Facebook reacted quickly, issuing a fix within two hours from acknowledgement of Muthiyah's report. Facebook also paid him $12,500 through the company's bug bounty program.

More than 2 billion photos are shared daily across Facebook, CEO Mark Zuckerberg said last month during the company's fourth-quarter earnings call.

Facebook is not aware of any misuse of the vulnerability, a source at the company said. Also, triggering it would have required knowledge of the ID of the person's photo album based on its URL, as well as permission to view the album based on the album's privacy settings.

The issue could not enable someone to log into another's account, nor did it allow access to view any other part of a person's account.

$12,500 is above average for a Facebook bug bounty reward, with $500 being the minimum reward. Last year a computer engineer was awarded $33,500 for discovering a vulnerability that could have allowed a hacker to read almost any file on a Facebook server.

Zach Miners covers social networking, search and general technology news for IDG News Service. Follow Zach on Twitter at @zachminers. Zach's e-mail address is zach_miners@idg.com

To express your thoughts on Computerworld content, visit Computerworld's Facebook page, LinkedIn page and Twitter stream.
Windows 10 annoyances and solutions
Shop Tech Products at Amazon
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.