Facebook said to fix OAuth-based account hijacking flaw
The vulnerability could have allowed attackers to steal OAuth tokens and access Facebook account, a researcher says
IDG News Service - Facebook has patched a serious vulnerability that could have allowed attackers to easily gain access to private user account data and control accounts by tricking users into opening specifically crafted links, a Web application security researcher said late Thursday.
Nir Goldshlager, the researcher who claims to have found the flaw and reported it to Facebook, posted a detailed description and video demonstration of how the attack worked on his blog.
The vulnerability would have allowed a potential attacker to steal sensitive pieces of information known as OAuth access tokens. Facebook uses the OAuth protocol to give third-party applications access to user accounts after users approve them. Each application is assigned a unique access token for every user account.
Goldshlager found a vulnerability on Facebook's websites for mobile and touch-enabled devices that stemmed from improper sanitization of URL paths. This allowed him to craft URLs that could have been used to steal the access token for any application a user had installed on their profile.
While most applications on Facebook are third-party apps that users need to manually approve, there are a few built-in applications that are pre-approved. One such application is Facebook Messenger; its access token doesn't expire unless the user changes his password and it has extensive permissions to access account data.
Facebook Messenger can read, send, upload and manage messages, notifications, photos, emails, videos, and more. The URL manipulation vulnerability found on m.facebook.com and touch.facebook.com, could have been exploited to steal a user's access token for Facebook Messenger, which would have given the attacker full access the account, Goldshlager said.
The attack URL could have been shortened with one of the many URL shortener services and sent to users masquerading as a link to something else. The attack would also have worked on accounts that had Facebook's two-factor authentication enabled, Goldshlager said.
With the access token and the Facebook user ID, an attacker can extract information from the user account by using the Graph API Explorer, a tool for developers available on Facebook's site, Goldshlager said Friday via email.
According to Goldshlager, the Facebook Security Team fixed the vulnerability. "Facebook has a professional security team and they fix issues very fast," he said.
"We applaud the security researcher who brought this issue to our attention and for responsibly reporting the bug to our White Hat Program," a Facebook representative said Friday via email. "We worked with the team to make sure we understood the full scope of the vulnerability, which allowed us to fix it without any evidence that this bug was exploited in the wild. Due to the responsible reporting of this issue to Facebook, we have no evidence that users were impacted by this bug. We have provided a bounty to the researcher to thank them for their contribution to Facebook Security."
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts