A critical Facebook flaw exposed email address for any account, the discovery was made by Stephen Sclafani, security researcher and founder of PlayToWin.
Another vulnerability menaces privacy of Facebook users allowing the disclosure of primary email address of any account.
Stephen Sclafani, security researcher and founder of
PlayToWin, described the attack technique in a blog
post titled “Obtaining The Primary Email Address Of Any Facebook User” explaining how account owners are exposed to risk of cyber attacks such as phishing.
Facebook users have to provide a valid email address when sign up to the popular social network, the email used becomes the user’s primary email address.
The researcher revealed the presence of a Facebook flaw in the invitation process that is used to involve other user to join in the social network.
The following image shows the invitation email received by a user that request it clicks an embedded URL to sign-up the service.
Once clicked on the sign-up link the user is redirected to a sign-up page having already filled email address and the user name fields. Following the page presented when user click on the link to sign up for an account:
The URL accepts two parameters in this URL, “re” and “mid”, manipulating them, in particular changing part of “mid” one an attacker could expose the email address of another user.
http://www.facebook.com/r.php?re=245bf2da75118af20d917bdd34babddb&mid=59b63aG5af3107aba69G0G46
59b63a G 5af3107aba69 G 0 G 46
“Only the second value was important. The value was an ID associated with the address that the invitation was sent to in hex. A Facebook user’s numerical ID could be put as this value and their primary email address would be displayed. A user’s numerical ID is considered public information and can be obtained from the source of their profile or through the Graph API.”
Using this Facebook flaw a hacker can retrieve email address of all Facebook profiles simple writing an automated script to grab all email address of billions of Facebook users.
My coleague at The Hacker News Magazine proposed simple procedure to follow for the hack using an automated script to grab all emails:
- Grab profile links of all facebook users from Facebook People Directory i.e http://www.facebook.com/directory/people/
- Collect facebook ID for each ID from facebook Graph API i.e http://graph.facebook.com/mohitkumar.thehackernews, where user ID is 1251386282.
- In Next step, using curl or other method open the modified URL for each profile ie http://www.facebook.com/r.php?re=245bf2da75118af20d917bdd34babddb&mid=59b63aG1251386282G0G46
- Filter the email address and store that into database from the Source code obtained from above step for each profile.
There is no limit on potential exploit of these vulnerabilities, social network users are everywhere, in private companies and government offices so it is crucial an awareness campaign about the risks related to cyber threats and of course it is principal service providers such as Facebook must promptly respond to the discovery of the flaw. In this specific case the issue was reported to Facebook on March 22th and it was fixed within 24 hours …
excellent! A bounty of $3,500 was rewarded as Stephen as part of their
Bug Bounty program.
Pierluigi Paganini
Pierluigi Paganini Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.
