News

Hacker Found Way into Any Facebook Account

An Indian hacker has found a remarkably simple way to access any Facebook user account. Thankfully, Anand Prakash, a security engineer from Bangalore, is a “white hat” hacker and immediately contacted Facebook about the loophole, granting him a $15,000 reward.

In a blog post – with the provocative title “How I could have hacked all Facebook accounts” – Prakash explained the process he used, including a proof-of-concept video. Effectively, he brute-forced the password reset code – a six-digit number which is sent to the user’s phone or e-mail – on Beta version of Facebook, which allowed him unlimited input attempts without locking him out. He was then able to set his own password with which he could fraudulently access other user’s accounts.

“Whenever a user Forgets his password on Facebook, he has an option to reset the password by entering his phone number/ email address on https://www.facebook.com/login/identify?ctx=recover&lwv=110 ,Facebook will then send a 6 digit code on his phone number/email address which user has to enter in order to set a new password,” Prakash wrote. “I tried to brute the 6 digit code on www.facebook.com and was blocked after 10-12 invalid attempts.”

“Then I looked out for the same issue on beta.facebook.com and mbasic.beta.facebook.com and interestingly rate limiting was missing on forgot password endpoints,” he added. “I tried to takeover my account (as per Facebook’s policy you should not do any harm on any other users account) and was successful in setting new password for my account. I could then use the same password to login in the account.”

According to his blog, Prakash discovered the vulnerability on 22nd February, and received his $15,000 reward from Facebook on 2nd March. Facebook is yet to confirm the veracity of Prakash’s blog post.

Ashley Allen

Disqus Comments Loading...

Recent Posts

MSI MPG B650 Carbon WIFI (Socket AM5) DDR5 ATX Motherboard

ColourPrimary ColourBlackDimensionsLength30.5 cmWidth24.4 cmLightingLightingYesLighting ColourRGBWiFi & LANLAN ports1x 2.5 Gbit/sStorage PortsSATA 6G (internal)6M.2 PCIe 4.0…

9 hours ago

Asus ROG Strix B760-I Gaming WIFI (LGA 1700) DDR5 ITX Motherboard

MotherboardMotherboard ChipsetIntel B760CPUCPU ManufacturerIntelCPU Socket1700Form FactorMotherboard formfactorMini-ITXDimensionsLength17 cmWidth17 cmInternal PortsCPU Power Supply1x 8-PinUSB 3.0 /…

9 hours ago

Zotac GeForce RTX 3050 Twin Edge LHR 8192MB GDDR6 PCI-Express Graphics Card

ColourPrimary ColourBlackGraphics CardGPU SeriesRTX 30 SeriesFeaturesVirtual Reality ReadyYesClock SpeedsMax. Memory Clock14000 MHzMax. GPU Clock (Boost)1777…

9 hours ago

Kolink Observatory MX Mesh ARGB Midi Tower Case

Mid-tower PC case with dual-tone design and half-hinged tempered glass panel Mesh front panel and…

9 hours ago

LG 27″ 3840×2160 IPS 144Hz 1ms FreeSync/G-Sync HDMI 2.1 Widescreen Gaming Monitor

The UHD 4K display supports the express high-fidelity colour for reproducing vivid scenes. This monitor…

9 hours ago

Kolink Inspire Series K6 ARGB Micro-ATX Case 

Striking front panel with brushed aluminium look and ARGB lighting Tempered glass side panel and…

9 hours ago