Pierluigi Paganini December 24, 2016

A Facebook hack could have been exploited to retrieve the private email address of any user with a serious impact on the privacy.

A smart Facebook hack allowed to retrieve the private email address of any user. The issue was discovered by the hacker Tommy DeVoss who awarded with $5,000 under the Facebook Bug bounty program.

“The hack allowed me to harvest as many email addresses as I wanted from anybody on Facebook,” DeVoss said. “It didn’t matter how private you thought your email address was – I could of grabbed it.”

The expert discovered the vulnerability on Thanksgiving Day and reported it Facebook via its bug bounty program.

The issue resides in the user-generated Facebook Groups feature that allows any member to create an affinity group. The administrator of a Facebook Group could invite any Facebook member to have admin roles, the invitation is handled by Facebook and sent to the member’s Facebook Messages inbox. The invitation is also sent to the email address associated with invited member’s account. DeVoss discovered that even when users decide to keep their email address private he was able to discover it.

The expert discovered the problem when he canceled pending invitations. He switched to Facebook’s mobile view of the Page Roles tab from which he was able to view the full email addresses of anyone he wanted to cancel from becoming a Facebook Group Administrator.

“While Facebook waits for the confirmation, the user is forwarded to a Page Roles tab that includes a button to cancel the request,” he explained in a blog post.

“I noticed that when you clicked to cancel the administrator invitation on the mobile page, you were redirected to a page with the email address in the URL,” he said. “Now all you have to do is pluck the plaintext version of the confidential email address straight from the URL.”

Clicking on the remove invitation link on the mobile page, the expert was redirected to a page with the following URL:

The above URL will reveal the private email of the invited user in the parameter ‘removependinginvite_email’.

This Facebook hack could have a serious impact on the user privacy, threat actors could be interested in collecting the private email addresses to conduct a wide range of malicious activities.

“Harvesting email addresses this way contradicts Facebook’s privacy policy and could lead to targeted phishing attempts or other malicious purposes.” states the post.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Facebook hack, hacking)