Vulnerability in Facebook's OAuth allowed hacker full profile access

Feb 26, 2013 by Bob Yirka weblog
Credit: nirgoldshlager.com

(Phys.org)—Nir Goldshlager writer of a security blog, is reporting that he found a vulnerability in Facebook's OAuth that allowed him full access to an individual's profile information. Facebook confirmed the vulnerability and has subsequently fixed the problem, but questions still linger about how safe user data is from developers who possess expert knowledge of the social giant's inner workings.

As most Facebook users know, if they wish to add an app to Facebook, they must first click an "accept" button when presented with one from the app asking for permission. It allows the app to access private profile information, which is necessary for the app to run. What Goldshlager found was a hole in this process—known as OAuth to developers—that allowed him to gain access to (in and outbox, ads pages, photo's etc.) without their permission.

The OAuth service is run by sending a URL—Goldshlager modified the URL in a way that allowed him to send a user to a page he had created himself where an access token would be stored, bypassing the instigation of the popup that would ask the user for access permission. Using this method, he was able to give himself permission to access a particular user's account profile information without the user being aware of what had occurred. There are two important things to note here: first, there is no evidence that any hackers knew of the vulnerability and used it to gain access to a user's information, and second, that the vulnerability works only on a single user account.

Because the vulnerability only works on one account at a time, it means a would not have been able to use it to create a program to steal account information from groups of users—it would have had to have been a personal attack, i.e. a single hacker trying to crack a single account. For that reason, Goldshlager and Facebook are reasonably sure that no one ever took advantage of the . Only those who develop applications might have ever stumbled across it, and had they, the monetary reward offered by Facebook via its White Hat program (which Goldshlager says he received for his efforts) would in most instances outweigh any other alternative actions they might be considering.

Goldshlager also reports that he's found other authorization bugs with , though he didn't go into detail on them. But his findings have created an air of uneasiness surrounding the degree of access developers gain with user accounts and what bugs might exist in the services they use that might allow a less honest hacker to gain personal data and use it for nefarious purposes.

Explore further: Facebook tuning mobile search at social network

Related Stories

Facebook fixes photo privacy bug

Dec 07, 2011

Facebook has fixed a bug that allowed the viewing of some private photographs of other members and which was reportedly used to access personal pictures of founder Mark Zuckerberg.

Facebook leaked keys to account data: Symantec

May 11, 2011

US computer security firm Symantec has said that Facebook accidentally left a door open for advertisers to access profiles, pictures, chat and other private data at the social network.

Recommended for you

Startups offer banking for smartphone users

17 hours ago

The latest banks are small enough to fit in the palm of your hand. Startups, such as Moven and Simple, offer banking that's designed specifically for smartphones, enabling users to track their spending on the go. Some things ...

'SwaziLeaks' looks to shake up jet-setting monarchy

Aug 29, 2014

As WikiLeaks founder Julian Assange prepares to end a two-year forced stay at Ecuador's London embassy, he may take comfort in knowing he inspired resistance to secrecy in places as far away as Swaziland.

Ecuador heralds digital currency plans (Update)

Aug 29, 2014

Ecuador is planning to create what it calls the world's first digital currency issued by a central bank, which some analysts believe could be a first step toward abandoning the country's existing currency, ...

WEF unveils 'crowdsourcing' push on how to run the Web

Aug 28, 2014

The World Economic Forum unveiled a project on Thursday aimed at connecting governments, businesses, academia, technicians and civil society worldwide to brainstorm the best ways to govern the Internet.

User comments : 0