Tuesday, September 3, 2013

Indian Engineer Gets $12.5k Bounty From Facebook

Facebook had a security bug that could be exploited to delete any image on the social networking site posted by anyone, without the original poster's knowledge and approval.

Interestingly, an Indian electronics and communications engineer, Arul Kumar, discovered this vulnerability and shared it with Facebook under its Whitehat bug reporting program, winning a $12,500 bounty in the process.

The 21-year old engineer from Tamil Nadu, discovered that the mobile version of Facebook's Support Dashboard, which allows users to flag and report a picture for removal, could be exploited to remove any photograph posted by any Facebook user.

When a user sends a photo removal request through the Support Dashboard, usually Facebook takes a look and decides if it should be removed or not. If Facebook decides not to remove it, then the user has the option of sending a message to the user who has posted the picture with a request to remove the same picture. The request also contains a link, clicking on which leads to the removal of the photo.

Kumar discovered that while sending a removal request, a user can manually modify the Photo_id and the photo owner's Profile_id parameters, following which the photo removal link can be sent to one's own Facebook ID and used to delete the photo without the original uploader's knowledge. Using the same method, any picture on Facebook could be deleted without the involvement of the user who originally posted the picture.

As per Kumar, the same exploit could have been used for removing photos posted by even verified users, fan pages and groups and from status updates, photo albums, suggested posts and comments.
When Kumar first shared the vulnerability with Facebook, it was dismissed, with the Facebook security team unable to delete any pictures through the suggested hack. Following this, Kumar sent Facebook a proof of concept video demonstrating the bug through a dummy account. The second attempt was fruitful and the Facebook security team was able to see the vulnerability.

Shared From NDTV

Latest News

LOADING LATEST NEWS....

Loading Blog Posts...

Loading Images...

Loading Videos...

Unknown

- Unknown Updated at: Tuesday, September 03, 2013

Thursday, August 22, 2013

Facebook Hacker Khalil Receives $12K from Online Donors

The hacker who broke into Mark Zuckerberg's Facebook Timeline to expose a security lapse will be awarded nearly $12,000 from an online crowdsourced campaign.

The GoFundMe campaign has raised $11,741 for Khalil Shreateh, of Palestine, who claims he was forced to hack into Zuckerberg's page to bring attention to the security vulnerability because Facebook had ignored his earlier warnings.

The bug that Shreateh found allowed him to post on the Timelines of people who weren't his Facebook friends.

The reward for his work was arranged by Marc Maiffret, the chief technology officer of security firm BeyondTrust.

'Khalil Shreateh found a vulnerability in Facebook.com and, due to miscommunication, was not awarded a bounty for his work,' Maiffret wrote on the GoFundMe campaign page. 'Let us all send a message to security researchers across the world and say that we appreciate the efforts they make for the good of everyone.'

Facebook has a 'Bug Bounty' program that pays out at least $500 to hackers who bring software bugs to the company's attention. But the company said Shreateh would not qualify for a reward because he tested the bug against another user.

Joe Sullivan, Facebook's Chief Security Officer, explained the company's decision in a post online.

'We will not change our practice of refusing to pay rewards to researchers who have tested vulnerabilities against real users,' he wrote. 'It is never acceptable to compromise the security or privacy of other people. In this case, the researcher could have sent a more detailed report (like the video he later published), and he could have used one of our test accounts to confirm the bug.'

Shreateh first contacted the Facebook security team after proving the glitch was real by writing on the wall of a friend of the Facebook founder.

But instead of thanking him and fixing the issue, Facebook said it wasn’t a bug.

‘My name is Khalil Shreateh. I finished school with B.A degree in Information Systems . I would like to report a bug in your main site (www.facebook.com) which i discovered it...The bug allow Facebook users to share links to other facebook users , I tested it on Sarah.Goodin wall and I got success post.’

Shreateh, whose first language is Arabic, lives in Palestine and is in no way connected with Zuckerberg’s fellow Harvard alum Goodin. He hoped his ability to post to her page, nonetheless, would help prove his case to Facebook security.

However, instead of repairing the obvious security breach, Facebook replied to Shreateh by saying the issue ‘was not a bug.’

Undeterred, Shreateh used the glitch to hack his way onto Mark Zuckerberg’s Facebook page.

‘Sorry for breaking your privacy,’ he wrote in a since removed post to Zuckerberg, ‘I had no other choice…after all the reports I sent to Facebook team.’

Shreateh went on to recount his attempts to warn the website and posted a grab of the post on his blog.

Minutes later, his pleas were answered. Facebook contacted him demanding to know how he’d hacked their bosses personal page.

‘We fixed this bug on Thursday,’ wrote Matt Jones from Facebook’s security team in a Saturday post on Hacker News.

Facebook has a bounty program designed to bribe hackers into reporting glitches they find rather than exploiting them. Such validated reports are worth $500.