Facebook hack allowed to disclose email address for each FB user

A Facebook hack could have been exploited to retrieve the private email address of any user with a serious impact on the privacy.

A smart Facebook hack allowed to retrieve the private email address of any user. The issue was discovered by the hacker Tommy DeVoss who awarded with $5,000 under the Facebook Bug bounty program.

“The hack allowed me to harvest as many email addresses as I wanted from anybody on Facebook,” DeVoss said. “It didn’t matter how private you thought your email address was – I could of grabbed it.”

The expert discovered the vulnerability on Thanksgiving Day and reported it Facebook via its bug bounty program.

The issue resides in the user-generated Facebook Groups feature that allows any member to create an affinity group. The administrator of a Facebook Group could invite any Facebook member to have admin roles, the invitation is handled by Facebook and sent to the member’s Facebook Messages inbox. The invitation is also sent to the email address associated with invited member’s account. DeVoss discovered that even when users decide to keep their email address private he was able to discover it.

The expert discovered the problem when he canceled pending invitations. He switched to Facebook’s mobile view of the Page Roles tab from which he was able to view the full email addresses of anyone he wanted to cancel from becoming a Facebook Group Administrator.

“While Facebook waits for the confirmation, the user is forwarded to a Page Roles tab that includes a button to cancel the request,” he explained in a blog post.

“I noticed that when you clicked to cancel the administrator invitation on the mobile page, you were redirected to a page with the email address in the URL,” he said. “Now all you have to do is pluck the plaintext version of the confidential email address straight from the URL.”

Clicking on the remove invitation link on the mobile page, the expert was redirected to a page with the following URL:

The above URL will reveal the private email of the invited user in the parameter ‘removependinginvite_email’.

This Facebook hack could have a serious impact on the user privacy, threat actors could be interested in collecting the private email addresses to conduct a wide range of malicious activities.

“Harvesting email addresses this way contradicts Facebook’s privacy policy and could lead to targeted phishing attempts or other malicious purposes.” states the post.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Facebook hack, hacking)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.