Researcher rewarded for finding Facebook Business Manager account takeover flaw

September 20, 2016Share this content:Researcher Arun Sureshkumar found an Insecure Direct Object Reference vulnerability in Facebook Business Manager that, if exploited, could have resulted in targeted account takeovers.
Researcher Arun Sureshkumar found an Insecure Direct Object Reference vulnerability in Facebook Business Manager that, if exploited, could have resulted in targeted account takeovers.

An Indian security researcher recently earned a £16,000 bug bounty after responsibly disclosing a vulnerability in own blog post[2], published last week.

After learning of the vulnerability on Aug.

29, Facebook patched the bug by Sept.

6, the blog also reported. To achieve the hack, Sureshkumar created his own business account, and then added a partner from a second account that he also created. Playing the role of attacker, the researcher intercepted the vulnerable partner request, changing its asset ID with the ID of another Facebook page (the target of the hack) and swapping the IDs of the parent business and the partner account, ostensibly reversing their roles.

By re-sending the request, Sureshkumar now had admin-level privileges for the targeted page.

Using this technique, attackers could have hijacked any Facebook account and freely performed a variety of damaging actions, including page deletion, Sureshkumar reported.

“We appreciate all the researchers who work closely with our teams to improve the security of Facebook products,” said a Facebook spokesperson in an emailed statement to SCMagazine.com. “We’re happy to recognize and reward Arun for his excellent report.”

References

  1. ^ Facebook (www.scmagazine.com)
  2. ^ own blog post (arunsureshkumar.me)

You may also like...

Leave a Reply

Your e-mail address will not be published. Required fields are marked *

       
Apps & Games Clothing Electronics & Photo Large Appliances
Baby Womens Apparel Garden Lighting
Beauty Mens Apparel Outdoors Luggage
Books Girls Apparel Health & Personal Care Pet Supplies
Car Boys Apparel Home Shoes & Bags
Motorbike Computers & Accessories Kitchen Equipment Sports & Outdoors
Fashion DIY & Tools Jewellery Toys & Games