Hijacking a Facebook Account with SMS

Can you ever imagine that a single text message is enough to hack any Facebook account without user interaction or without using any other malicious stuff like Trojans, phishing, keylogger etc. ?

Today we are going to explain you that how a UK based Security Researcher, "fin1te" is able to hack any Facebook account within a minute by doing one SMS.

This post will demonstrate a simple bug which will lead to a full takeover of any Facebook account, with no user interaction. Enjoy.

Facebook gives you the option of linking your mobile number with your account. This allows you to receive updates via SMS, and also means you can login using the number rather than your email address.
The flaw lies in the /ajax/settings/mobile/confirm_phone.php end-point. This takes various parameters, but the two main are code, which is the verification code received via your mobile, and profile_id, which is the account to link the number to.
The thing is, profile_id is set to your account (obviously), but changing it to your target’s doesn’t trigger an error.
To exploit this bug, we first send the letter F to 32665, which is Facebook’s SMS shortcode in the UK. We receive an 8 character verification code back.

We enter this code into the activation box (located here), and modify the profile_id element inside the fbMobileConfirmationForm form.

Submitting the request returns a 200. You can see the value of __user (which is sent with all AJAX requests) is different from the profile_id we modified.

Note: You may have to reauth after submitting the request, but the password required is yours, not the targets.
An SMS is then received with confirmation.

Now we can initate a password reset request against the user and get the code via SMS.

Another SMS is received with the reset code.

We enter this code into the form, choose a new password, and we’re done. The account is ours.

Fix

Facebook responded by no longer accepting the profile_id parameter from the user.

Timeline

23rd May 2013 - Reported
28th May 2013 - Acknowledgment of Report
28th May 2013 - Issue Fixed

Note

The bounty assigned to this bug was $20,000, clearly demonstrating the severity of the issue.

Facebook Security Bug Exposes Account Information of 6 Million Users

Up to six million Facebook users' personal e-mail addresses and phone numbers have been exposed, and not through a hack.
Facebook reported late Friday afternoon that a software bug or glitch in its systems left users' personal information exposed to people who weren't necessarily their friends on the service. The social network has fixed the issue and is informing affected users.
"We recently received a report to our White Hat program regarding a bug that may have allowed some of a person's contact information (email or phone number) to be accessed by people who either had some contact information about that person or some connection to them," Facebook's Security team wrote in a post published on Friday at around 5 p.m. ET.
The team explained that the bug or glitch, while very technical, was a result of the feature that allows Facebook to access users' contact lists or address books. That feature allows Facebook to suggest that you be friends with the people in your address book on the social network. It will either suggest you become their friend on the service, if they are already on it, or that you invite them to the service.
Here's what the bug was doing: If you had uploaded your address book and you had a friend named Karen with the e-mail address karen@gmail.com and karen@someplace.com, Facebook would house that information in its database. When Mark joined Facebook and put in his address book with just Karen's karen@gmail.com address, it would suggest that he become friends with Karen and maybe even you.


But with the glitch, if Mark had then used Facebook's Download Your Information tool, he would have been given Karen's other email address -- karen@someplace.com -- even though he had never had it.
"As a result, if a person went to download an archive of their Facebook account through our Download Your Information (DYI) tool, they may have been provided with additional email addresses or telephone numbers for their contacts or people with whom they have some connection," Facebook explained.
Facebook said that some of that information provided might have been inaccurate and believes that the six million Facebook users who had their email or telephone numbers shared with people only had it shared once. Additionally, it was likely shared with someone they knew through someone else.
"This means, in almost all cases, an email address or telephone number was only exposed to one person. Additionally, no other types of personal or financial information was included and only people on Facebook -- not developers or advertisers -- have access to the DYI tool," the post read.
The social network said there is "no evidence" that the bug was exploited by hackers. McAfee security expert Robert Siciliano also believed that it probably wasn't.
"It's still disturbing, however, that it happened in the first place," Siciliano said. "Certainly, it's good that Facebook is bringing this to the public's attention. Facebook knows it needs to be vigilant and consumers need to be, too."
Siciliano said the chances of this affecting a person's identity were very slim, but he said consumers should be on the look out for fake emails from Facebook or other organizations. He also reminded users that they should change their passwords every six months.
"Our information is out there and it is of value," he said. "As long as we put it out there we have to know there are risks as a result."