Pierluigi Paganini
May 18, 2013
Facebook has many vulnerabilities exactly as any other software and daily hackers try to exploit them, the primary concerns of security experts are related to flaws in the popular social network that could all allow attackers to inject external malicious links or images to the Facebook bulletin board.
Using injection techniques the attackers could elude security mechanisms and hijack a Facebook account with serious repercussion on user’s privacy.
The popular security expert Nir Goldshlager, Founder/CEO of Break Security, found a serious vulnerability that allows attacker to post spoofed messages from any application on Facebook such as Spotify, Skype and Pinterest.
The vulnerability is still unfixed today and it makes possible data spoofing from any Facebook app.
Let’s step to 2012 analyzing the method used by Facebook to publish content on the wall called stream.publish, the Stream Publish Dialog has the following format:
https://www.facebook.com/dialog/stream.publish?app_id=xxxx&redirect_uri=http://www.facebook.com/&action_links=&attachment=%7B%27media%27:%20[%7B%27type%27:%20%27flash%27,%27swfsrc%27:%27http://files.nirgoldshlager.com/goldshlager2.swf%27,%27imgsrc%27:%27http://www.vectorstock.com/i/composite/41,30/hacked-pc-vector-194130.jpg%27,%27width%27:%27130%27,%27height%27:%27%20130%27,%27expanded_width%27:%27500%27,%27expanded_%20height%27:%27500%27%7D],%27name%27:%27xxxx%27,%27caption%27:%27xxxx%20Application%27,%27properties%27:%7B%27xxx%27:%7B%27text%27:%27Download%20xxx%27,%27href%27:%27http://nirgoldshlager.com%27%7D%7D%7D
A hacker could manipulate the app_id and attachment (swfsr,imgsrc,href) parameters to conduct an attack. If the “Stream post URL security” option is disabled by the author of that application, a hacker can upload specifically crafted content, like a swf file, as attachment parameter.
In the post on the Break security web site is reported:
“every time a victim visits my wall post, they will see content spoofing from a Facebook application that they generally trust. Clicking the link on the post makes an swf file from the external website execute on his client machine.“
In 2013 the situation is changed, Facebook eliminated the stream.publish option, instead opting for a Feed Dialog to publish app activity.
Nir Goldshlager has not lost his nerve and analyzed the Feed Dialog and the parameters used to spoof app content.
Following the details of parameters used in Feed Dialog
The post proposes a proof of concept video that present the Facebook hack for some various applications such as Skype and SoundCloud.
SoundCloud:
https://www.facebook.com/dialog/feed?app_id=19507961798&link=http://nmap.org/dist/nmap-6.20BETA1-setup.exe&picture=http://www.atpfestival.com/assets/img/soundcloud.png&name=Download%20SoundCloud%20For%20Windows&%20caption=http://soundcloud.com&description=&%20redirect_uri=https://facebook.com
Skype:
https://www.facebook.com/dialog/feed?app_id=260273468396&link= https://touch.facebook.com/apps/sdfsdsdsgs &picture=http://he.downloadastro.com/static/files/24/3b/29/243b29a6163cc99e359f4c354422f238.jpg&name=Download%20Skype%20New%20Version&%20caption=http://skype.com&description=&%20redirect_uri=https://facebook.com
The author suggests the following solutions to solve the problem:
The flaw discovered by Goldshlager allow cyber criminals to spoof the content of any Facebook application, they could adopt the technique of attack to install malicious code on the user’s machine or deceive user with social engineering attack.
Pierluigi Paganini
(Security Affairs – Hacking)
