Categories: HackingSecurity

Nir Goldshlager reveals how to hack Facebook Apps

The popular security expert Nir Goldshlager found  a serious vulnerability that allows attackers to post spoofed messages from any application on Facebook.

Facebook has many vulnerabilities exactly as any other software and daily hackers try to exploit them, the primary concerns of security experts are related to flaws in the popular social network that could all allow attackers to inject external malicious links or images to the Facebook bulletin board.

Using injection techniques the attackers could elude security mechanisms and hijack a Facebook account with serious repercussion on user’s privacy.

The popular security expert Nir Goldshlager,  Founder/CEO of Break Security, found  a serious vulnerability that allows attacker to post spoofed messages from any application on Facebook such as Spotify, Skype and Pinterest.

The vulnerability is still unfixed today and it makes possible data spoofing from any Facebook app.

Let’s step to 2012 analyzing the method used by Facebook to publish content on the wall called stream.publish, the Stream Publish Dialog has the following format:

https://www.facebook.com/dialog/stream.publish?app_id=xxxx&redirect_uri=http://www.facebook.com/&action_links=&attachment=%7B%27media%27:%20[%7B%27type%27:%20%27flash%27,%27swfsrc%27:%27http://files.nirgoldshlager.com/goldshlager2.swf%27,%27imgsrc%27:%27http://www.vectorstock.com/i/composite/41,30/hacked-pc-vector-194130.jpg%27,%27width%27:%27130%27,%27height%27:%27%20130%27,%27expanded_width%27:%27500%27,%27expanded_%20height%27:%27500%27%7D],%27name%27:%27xxxx%27,%27caption%27:%27xxxx%20Application%27,%27properties%27:%7B%27xxx%27:%7B%27text%27:%27Download%20xxx%27,%27href%27:%27http://nirgoldshlager.com%27%7D%7D%7D

A hacker could manipulate the  app_id and attachment (swfsr,imgsrc,href) parameters to conduct an attack. If the “Stream post URL security” option is disabled by the author of that application, a hacker can upload specifically crafted content, like a swf file, as attachment parameter.

In the post on the Break security web site is reported:

every time a victim visits my wall post, they will see content spoofing from a Facebook application that they generally trust. Clicking the link on the post makes an swf file from the external website execute on his client machine.

In 2013 the situation is changed, Facebook eliminated the stream.publish option, instead opting for a Feed Dialog to publish app activity.

Nir Goldshlager has not lost his nerve and analyzed the Feed Dialog and the parameters used to spoof app content.

Following the details of parameters used in Feed Dialog

  1. Link parameter: With this parameter, we will include our malicious external link (virus exe file, 0days, Phishing site, or any other malicious link.
  2. Picture Parameter: This parameter is only usable if we want to spoof the content with an image. The content of the image will only display correctly on our Wall post. It will not display correctly in the newsfeed, making it relevant only to wall post app spoofing.
  3. Caption Parameter: This parameter will allow to an attacker choose from which website the content came from, For Example: Facebook.com Zynga.com Ownerappdomain.com
  4. Name Parameter: This parameter produces the title we desire. Whenever the victim clicks on that title, he will be taken to our malicious website.

The post proposes a proof of concept video that present the Facebook hack for some various applications such as Skype and SoundCloud.

SoundCloud:

https://www.facebook.com/dialog/feed?app_id=19507961798&link=http://nmap.org/dist/nmap-6.20BETA1-setup.exe&picture=http://www.atpfestival.com/assets/img/soundcloud.png&name=Download%20SoundCloud%20For%20Windows&%20caption=http://soundcloud.com&description=&%20redirect_uri=https://facebook.com

Skype:

https://www.facebook.com/dialog/feed?app_id=260273468396&link= https://touch.facebook.com/apps/sdfsdsdsgs &picture=http://he.downloadastro.com/static/files/24/3b/29/243b29a6163cc99e359f4c354422f238.jpg&name=Download%20Skype%20New%20Version&%20caption=http://skype.com&description=&%20redirect_uri=https://facebook.com

 The author suggests the following solutions to solve the problem:

  • Use  Stream post URL >
  • Use Bonus Video (Advanced Spoofing Apps Links, Fixed By Facebook Security 2012)
  • Use  Stream post URL >

The flaw discovered by Goldshlager allow cyber criminals to spoof the content of any Facebook application, they could adopt the technique of attack to install malicious code on the user’s machine or deceive user with social engineering attack.

Pierluigi Paganini

(Security Affairs – Hacking)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

US Government officials targeted with texts and AI-generated deepfake voice messages impersonating senior U.S. officials

FBI warns ex-officials are targeted with deepfake texts and AI voice messages impersonating senior U.S.…

6 hours ago

Shields up US retailers. Scattered Spider threat actors can target them

Google warns that the cybercrime group Scattered Spider behind UK retailer attacks is now targeting…

9 hours ago

U.S. CISA adds Google Chromium, DrayTek routers, and SAP NetWeaver flaws to its Known Exploited Vulnerabilities catalog<gwmw style="display:none;"></gwmw>

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chromium, DrayTek routers, and SAP NetWeaver…

15 hours ago

Pwn2Own Berlin 2025 Day Two: researcher earned 150K hacking VMware ESXi

On day two of Pwn2Own Berlin 2025, participants earned $435,000 for demonstrating zero-day in SharePoint,…

1 day ago

New botnet HTTPBot targets gaming and tech industries with surgical attacks

New botnet HTTPBot is targeting China's gaming, tech, and education sectors, cybersecurity researchers warn. NSFOCUS …

1 day ago

Meta plans to train AI on EU user data from May 27 without consent

Meta plans to train AI on EU user data from May 27 without consent; privacy…

2 days ago