Feeds

Crusty API opened Facebook accounts to hijacking

Dodgy endpoint earnt research 20 large

Intelligent flash storage arrays

A leftover API that Facebook forgot to kill has left accounts open to spammers and scammers, says security Stephen Sclafani. The flaw means an attacker could view other users' messages and post status updates.

Sclafani found that a then mis-configured endpoint, since patched, allowed legacy REST API calls to be made on behalf of any Facebook fanatic provided their user ID was known.

The REST API endpoint was the still-active predecessor of Facebook's core Graph API that allowed developers to read and write data to Facebook.

Skilled attackers could exploit the vector to gain almost the same control of accounts as legitimate users. They could update users' statuses including posting links to friend timelines; publish and delete comments and notes; upload and delete photos, and 'like' content.

Sclafani said the API authentication flows were also vulnerable allowing for full account takeover, but were less likely to be successful as users had to click on an attackers' links.

"All of this could be done without any interaction on the part of the user," Sclafani (@Stephen) said.

"Both the REST API web and desktop authentication flows were vulnerable to CSRF (cross-site request forgery) issues that led to full account takeover.

The legacy API was still used by many applications including Facebook's mobile app and so was not simply discarded, Facebook's security team said.

While there was no indication the flaw was exploited, nefarious minds could concoct a variety of means to monetise exploitation by blackmailing users of sensitive or high-profile accounts or by spamming inboxes.

Sclafani reported the flaw to Facebook in April and published details part one of a two-part blog this week. Menlo Park paid him a tidy $20,000 under its bug bounty program.

Loads of technical details are available on his blog. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.