Attackers chained three bugs to breach into the Facebook platform

Facebook has revealed additional details about the cyber attack that exposed personal information of 50 million accounts.

Last week, Facebook announced that attackers exploited a vulnerability in the “View As” feature that allowed them to steal Facebook access tokens of 50 Million Users.

The “View As” feature allows users to see how others see their profile, it was implemented under the privacy section to help users to check that only intended data is visible for their public profile.

Facebook noticed a traffic spike on September 16 but determined that is was under attack on September 25, when it also discovered the way attackers breached the platform. The incident was disclosed on September 27.

Facebook disabled the “View As” feature in response to the incident, the company reset the security tokens for the 50 million impacted accounts, and as a precautionary measure, reset them for other 40 million accounts.

Attackers also accessed data of the Facebook founder Mark Zuckerberg and the COO Sheryl Sandberg. Facebook is notifying users whose tokens have been compromised.

According to Facebook, the vulnerability is the result of the chaining of three flaws affecting the “View As” feature and the Facebook’s video uploader.

The company clarified that the version of the video uploader interface affected by the vulnerability was introduced in July 2017.

1. Experts noticed that the “View As” allows displaying the profile as a read-only interface. but the platform fails to validate the content submitted through text box that allows people to wish happy birthday to their friends(this is the first bug). The experts discovered that it is possible to post a video through this field.
2. The second issue is related to the fact that the video uploader generated an access token that had the permissions of the Facebook mobile app when posting a video in the text box.
3. The third bug is that the token generated was not for the user who had been using “View As” but for the one whose profile was being viewed, this means that attackers could obtain the token from the page’s HTML code and use it to take over a targeted user’s account.

It is interesting to note that an attacker would first hack into a friends’ account and move target other accounts connected to it.

“It was the combination of these three bugs that became a vulnerability: when using the View As feature to view your profile as a friend, the code did not remove the composer that lets people wish you happy birthday; the video uploader would generate an access token when it shouldn’t have; and when the access token was generated, it was not for you but the person being looked up. That access token was then available in the HTML of the page, which the attackers were able to extract and exploit to log in as another user.” explained Guy Rosen, VP of Product Management.

“The attackers not only needed to find this vulnerability and use it to get an access token, they then had to pivot from that account to others to steal more tokens.”

“The attackers were then able to pivot from that access token to other accounts, performing the same actions and obtaining further access tokens.” added edro Canahuati, VP of Engineering, Security and Privacy at Facebook.

According to Facebook, the attackers queried the APIs to access profile information, but no private information (private messages or credit card data) seems to have been accessed.

Another aspect that was underestimated is that the exposed tokens can be used to access third-party apps that allow the authentication using Facebook profile. The token reset also mitigated this risk.

Experts also warn that users who have linked Facebook to an Instagram account will need to unlink and re-link their accounts due to the reset of the tokens.

Based on the info shared by Facebook, the attack was probably carried out by advanced attackers.

In the next weeks, we will a clear picture of the impact of the hack on the company, the company could face $1.63 billion EU fine under EU GDPR.

Rumors of a class action lawsuit are circulating online.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Facebook hack, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]