Skip to main content

Another Facebook Bug Could Have Exposed Your Private Information

Another security vulnerability has been reported in Facebook that could have allowed attackers to obtain certain personal information about users and their friends, potentially putting the privacy of users of the world's most popular social network at risk.

Discovered by cybersecurity researchers from Imperva, the vulnerability resides in the way Facebook search feature displays results for entered queries.

According to Imperva researcher Ron Masas, the page that displays search results includes iFrame elements associated with each outcome, where the endpoint URLs of those iFrames did not have any protection mechanisms in place to protect against cross-site request forgery (CSRF) attacks.

It should be noted that the newly reported vulnerability has already been patched, and unlike previously disclosed flaw in Facebook that exposed personal information of 30 million users, it did not allow attackers to extract information from mass accounts at once.

How Does the Facebook Search Vulnerability Work?


To exploit this vulnerability, all an attacker needs to do is simply tricking users into visiting a malicious site on their web browser where they have already logged into their Facebook accounts.
facebook-hacking-software
The malicious site contains a javascript code that will get executed in the background as soon as the victim clicks anywhere on that page.

"For this attack to work we need to trick a Facebook user to open our malicious site and click anywhere on the site, (this can be any site we can run JavaScript on) allowing us to open a popup or a new tab to the Facebook search page, forcing the user to execute any search query we want," Masas explained in a blog post published today.

As demonstrated by Masas in the video shown below, the JavaScript code opens a new tab or window with a Facebook URL that runs certain predefined search queries and measures the result to extract targeted information.

Searching something on Facebook seems less lucrative, especially when the exploit code returns the result in just yes or no.

"The attack actually leaks the number of search results for any search query on the currently logged Facebook account. The most basic usage is to make boolean queries like 'photos of me from Iceland'," Masas told The Hacker News.
But if used correctly, Facebook's search feature could be exploited to extract sensitive information related to your Facebook account, such as checking:

And so on… any custom query you can come up with.
"This process can be repeated without the need for new popups or tabs to be open since the attacker can control the location property of the Facebook window," Masas added. "This is especially dangerous for mobile users, since the open tab can easily get lost in the background, allowing the attacker to extract the results for multiple queries, while the user is watching a video or reading an article on the attacker’s site."
In short, the vulnerability exposed interests and activities of targeted users and their friends even if their privacy settings are set in a way that this information can only be visible to them or their friends.

Imperva responsibly reported the bug to Facebook through the company's vulnerability disclosure program in May 2018, and the social network giant resolved the issue days later by adding CSRF protections.

Almost three months ago, Masas also reported an impressive web browser vulnerability that exposed everything other web platforms, like Facebook and Google, knows about you. He also released a proof of concept exploit of the bug.

Comments

Popular posts from this blog

Phishing Campaigns Targeting Google and Yahoo Accounts To Bypassing Two-Factor Authentication Several phishing campaigns targeting hundreds of individuals across the Middle East and North Africa. The attacker targers HRDs, journalists, political actors. Amnesty International published a report on multiple campaigns that traget self-described “secure email” services, such as Tutanota and ProtonMail and another campaign that aimed in bypassing two-factor authentication. Crafted Phishing Sites – Secure Email Providers The phishing campaign primarily targeted popular secure email service providers such as Tutanota and ProtonMail. Threat actors used a well-crafted phishing page – by obtaining the domain tutanota[.]org, whereas the original domain of the service provider is tutanota[.]com. A phishing attack is one of the dangerous social engineering attacks that leads to capture a victim’s username and password that will get store it to an attacker machine and reuse it l...

software development services in noida

Red Securium Company Provide Software Development  Service In Noida Combining technological competency with domain expertise, Red Securium offers full spectrum of custom software design, development and deployment services for enterprises and SMEs to achieve exceptional business results.            Leveraging on its cross-functional width of expertise in application software development , Red Securium has developed the capabilities to build and run resilient applications at scale that seamlessly infuse your innovative ideas. Whether you are in need of the rapid development of a crucial business application or require the deployment and support for an entire suite of applications, we offer full software lifecycle coverage services. We adopt best practices and put highest levels of expertise to drive your technological assets deliver you business excellence and improved ROI. Custom Software Development Services in Noida Enterpri...

Tr0ll 1.0 – Vulnhub CTF Challenge Walkthrough

  Tr0ll 1.0 is an intentionally vulnerable machine, which is more of a   CTF  like type than real world scenario. Nevertheless, this machine has its own difficulties and you can learn some new stuff from it. So, let’s start. Enumeration Phase Let’s first run  netdiscover  to find the IP of our machine. netdiscover -r 192.168.1.1/24 After that, we run our typical  nmap  scan to see the open ports in the machine. nmap -A -sS -Pn -vv [target] Great we see many interesting stuff here. First of all, there is an open  FTP  port and we can connect to it with  anonymous access .  Also there is an open  http  port, we will run a nikto scan for it. The  ssh  port will be valuable later. From the nikto scan we got an interesting  /secret/  folder. When we get inside, we can understand why the machine got this name. Nothing interesting here, as you can see. we got trolled Let’s connect ...