Arul Kumar, a 21 years old security researcher from Tamil Nadu, discovered a very serious Facebook bug that could let hackers delete anyone's photo from their Facebook account with even knowing them. According to Arul, this could be done by exploiting the support dashboard.
So how Arul exploited this bug to delete anyone's photo(even Mark Zuckerberg)? You know that there is an option for reporting photos, posts or profiles that you think are spam or inappropriate. If you report anyone's photo as inappropriate, this request goes to Facebook.
If Facebook decided not to delete that forcibly, that user gets a link that let him send a quick take down request whoever had uploaded that photo, with a one-click delete button. And Arul taken the advantage of that weakness by changing some of the parameters of the URL.
This could let him delete any photo, from any user, whether the photo belong to him or someone else, whether he is tagged or not, and even if the photo hadn't even reported by anyone or not. With this bug he could send a take down request for the photos of celebrities account like Shah Rukh Khan, Salman Khan, Rihanna, Akon, Enrique and literally any Facebook account, even Facebook's Founder Mark Zuckerberg's account also.
But now, the bug is fixed by Facebook, and Arul Kumar was paid $12,500 for this serious bug. At first Facebook's security team was not able to recognize this bug, but later Arul sent them a video demonstrating how he found this bug. You can see the video below which belongs to Arul Kumar.
In the video above he clearly demonstrated how he exploited the support dashboard to remove photos from victim's account. This bug was very easy to reproduce that, if a hacker creates a tool for this bug, this would let him delete photos from Facebook like someone deletes photos from his/her own computer.
What do you think about this? Let is know in the comments below. or you can also share this with your friends on Facebook and other social networking site.
No comments:
Post a Comment
Post comments only relevant to the topic. Do not spam. Comment must be meaningful and must add to the conversation. Comments containing more than 1 link will be deleted.