The social network recently fixed a bug discovered by a developer who
demonstrated how the loophole let him take over other people's accounts.
A security hacker recently found a flaw in a Facebook system that allowed developers to access anyone's Facebook account through app permissions.
Though Facebook has fixed this issue, Nir Goldshlager, a Web application
security specialist who looks for these types of flaws professionally,
found more app authorization bugs that need fixing, according to his blog.
App permissions are what developers use to access the user data needed
to run their apps. Users give them access permission when they install
the apps.
"I found a couple more OAuth flaws in Facebook, just waiting for a fix
to post about it," Goldshlager wrote in his blog, where he detailed his
findings.
Facebook wouldn't comment on what other flaws Goldshlager may have found
but did say the original bug he detected had not been taken advantage
of by actual Facebook developers. The company didn't say when
Goldshlager reported the flaw.
"We applaud the security researcher who brought this issue to our
attention and for responsibly reporting the bug to our White Hat
Program. We worked with the team to make sure we understood the full
scope of the vulnerability, which allowed us to fix it without any
evidence that this bug was exploited in the wild," a Facebook
representative wrote in an e-mail to CNET. "Due to the responsible
reporting of this issue to Facebook, we have no evidence that users were
impacted by this bug. We have provided a bounty to the researcher to
thank them for their contribution to Facebook Security."
The bug Goldschlager found allowed him to steal access tokens and gain
full access to a profile as a developer. This included messages, pages
management, ad management, private photos, and videos. This applied to
profiles that didn't install extra apps because he could go through
Facebook's built-in apps, like messenger, as well. The tokens for
third-party apps didn't expire unless the victim changed his or her
password, but the messenger app tokens for Facebook messenger never
expired, he wrote.
No comments:
Post a Comment