10-year vulnerability allows hacking any Facebook account

[DronVR]

10-year vulnerability allows hacking any Facebook account

Security Researcher Amol Baikar discovered critical vulnerability in the OAuth authentication protocol of the social network Facebook. The vulnerability has been around for 10 years, and its exploitation allows attackers to hack into any Facebook account.

The problem is contained in the “Login with Facebook” function, which uses the OAuth 2.0 authorization protocol for exchanging tokens between the social network and other websites.

A remote culprit could set up a malicious website to intercept OAuth traffic and steal authorization tokens that provide access to the accounts of targeted Facebook users.

After successfully exploiting the vulnerability, an attacker can send messages, publish something in the feed, modify account information, delete messages, and much more on behalf of the victim. A criminal can take control of other accounts, including Instagram, Oculus, as well as Netflix, Tinder, Spotify, etc.

Facebook users are advised to change the password for the account on the social network and log out of accounts on all devices.

Baikar told Facebook about the discovered vulnerability, and the company paid the researcher a reward of $ 55 thousand.




Source

 

[Turdubaev Dastan]

Well, like that. Problem with authorization via fb.