Facebook fixes flaw that could have let hackers delete photos

facebook messenger

Facebook quickly fixed a flaw that would have allowed hackers to delete users' photos.

Credit: Facebook

Facebook paid an outside developer $12,500 for discovering the flaw

The speed at which Facebook responded to a reported security vulnerability shows how important photos have become to the site.

The vulnerability could have allowed hackers to delete photos. An outside developer discovered the vulnerability in Facebook's Graph API, the primary way for outside developers to build apps and software that tap into Facebook's data.

The developer, identifying himself as Laxman Muthiyah in a blog post published Thursday, said he was able to use a mobile access token for the API to delete photo albums that were not his.

He alerted Facebook to the vulnerability and Facebook reacted quickly, issuing a fix within two hours from acknowledgement of Muthiyah's report. Facebook also paid him $12,500 through the company's bug bounty program.

More than 2 billion photos are shared daily across Facebook, CEO Mark Zuckerberg said last month during the company's fourth-quarter earnings call.

Facebook is not aware of any misuse of the vulnerability, a source at the company said. Also, triggering it would have required knowledge of the ID of the person's photo album based on its URL, as well as permission to view the album based on the album's privacy settings.

The issue could not enable someone to log into another's account, nor did it allow access to view any other part of a person's account.

$12,500 is above average for a Facebook bug bounty reward, with $500 being the minimum reward. Last year a computer engineer was awarded $33,500 for discovering a vulnerability that could have allowed a hacker to read almost any file on a Facebook server.

Zach Miners covers social networking, search and general technology news for IDG News Service. Follow Zach on Twitter at @zachminers. Zach's e-mail address is zach_miners@idg.com

A look inside the Microsoft Local Administrator Password Solution
View Comments
Join the discussion
Be the first to comment on this article. Our Commenting Policies