The Egyptian penetration tester Ahmed Elsobky discovered a serious flaw that allows attackers to sniff user’s traffic including access token.

“We’d actually received an earlier report from another researcher regarding this same issue. In response to that report, we’ve been working on limiting this behavior when it comes to our official apps, since they’re pre-authorized. For other apps, unfortunately, fully preventing this would mean requiring any site integrating with Facebook to use HTTPS, which simply isn’t practical for right now.” reported Facebook security team.

• The victim must be using a Facebook application(except: Facebook Messenger, Facebook Camera, Facebook for android/ios/symbian since these are pre-authorized apps).
• The victim must be already logged in and the attacker must be a Man In The Middle!

Let’s assume that the victim is using Skype then the attacker can get an access_token with the full permissions of that application by injecting this basic iframe into any webpage that the victim visits:

Facebook users can prevent Man-In-The-Middle attacks using HTTPS to encrypt traffic that contains sensitive information and following penetration tester’s suggestions:

1- Use “HTTPS Everywhere” Browser Extension(https://www.eff.org/https-everywhere)
2- Don’t use any popular app that doesn’t use a SSL (Secure Socket Layer) because HTTPS Everywhere won’t help you in this case then!

Pierluigi Paganini

(Security Affairs – Facebook Access Token , hacking)