Kittinan: facebook

Showing posts with label facebook. Show all posts

Impact :

The impact of vulnerability. it can change any photo of my own that was already published (without lost like and comment).

Description :
1. replace PHOTO_ID with photo you need to change https://graph.facebook.com/[PHOTO_ID]

2. attach photo you want to change on parameter url (https://developers.facebook.com/docs/graph-api/reference/photo#Updating)

3. use access_token from Facebook for Android to change photo

4. Done.

Timeline

May 5, 2015 at 3:51am – Report Sent
May 5, 2015 at 11:23am – Clarification by Facebook
May 5, 2015 at 11:35am – Clarification sent with video
May 5, 2015 at 12:29pm – Escalation by Facebook
June 12, 2015 – Ask progress to Facebook
June 12, 2015 – Response from Facebook (still discuss with team)
Sep 24, 2015 – Ask progress to Facebook
Sep 29, 2015 – Response from Facebook (The team is still working on this)
Oct 23, 2015 – Patched by Facebook
Nov 5, 2015 – Bounty Awarded of $1000 by Facebook

Today i founded the trick to find some friend on friend list ("Only Me" Privacy setting friend list).

Facebook concern people can see your friendship on another timeline

The trick use Facebook Friend Suggestion feature to find some friend of victim.

Instruction:

1. Register new Facebook user

2. Find the victim who want to know (Victim user need "Everyone" can send friend request on their privacy setting)

3. Use New Facebook user send friend request to victim and then cancel it.

4. go to : https://mbasic.facebook.com/friends/center/suggestions

5. you will get some friend of the victim

P.S. i wrote simple php script to fetch some friend of victim here

(https://gist.github.com/kittinan/64ec8ac80f58a3964c63)

P.S. i reported to facebook security team but they reply this is not a bug

On the 16 Jan 2014. I found the Token from Facebook Official Application and Facebook Messenger Application. That Token can access emails & phones of your friends without ask them depends on their privacy setting and this token also can get email & phones from not friends user if their has set public on privacy setting (You can't see email on the user who is not friend). ahh this token can query your friends of friends. it wonderful. i love this token.

That sure i reported this issue to Facebook security team, this is once of the answer

As https://www.facebook.com/help/359369650815737 notes, the privacy
setting of an email address controls who is able to see the information
outside of the context of Timeline. Shown on Timeline or Hidden from
Timeline are known as visibility settings and only control what information
is highlighted on your timeline. Can you demonstrate the ability to use
this token to access email addresses which you shouldn't be able to based
on privacy settings?

The tokens issued to the official applications have special permissions in order to allow them to function as efficiently as possible. Again, the application should not be able to return any information that it is not possible to access normally. Can you demonstrate a case where you are seeing the friend list for a friend where you could not otherwise see it?

Ok, Let's see how this work.

1. You must have Mobile device and installed Facebook Application, in this case i use my Android.

2. We will capture the special token from this software mitmproxy (http://mitmproxy.org/). This software that fake the certificate and make you can read https. Please see this blog for how mitmproxy work and use (http://blog.philippheckel.com/2013/07/01/how-to-use-mitmproxy-to-read-and-modify-https-traffic-of-your-phone/ )

3. After you learned the blog above you will got the special token when you open the facebook application and logged in