We all love Facebook but do we know how safe it is? Apparently, not as safe as it should be, as disclosed by the independent security researcher Jack Whitton also known as fin1te. The UK researcher just published an unbelievable story involving an XSS bug (cross-site-scripting) and Facebook’s content delivery network.
The researcher reported the bug back in July 2015 but didn’t go public just until few days ago.
Why Are XSS Bugs Dangerous?
What is an XSS vulnerability? An XSS-powered attack takes place when malicious actors implement malicious scripts to legitimate websites. An XSS vulnerability is exploited when you, for instance, send a website content that includes embedded malicious JavaScript. The website will later include the code in its reply.
Every time a website shows any content that comes from another source (such as an uploaded file or included in a URL address), the website should filter out any suspicious characters. Keep in mind that such characters usually include brackets and < > signs. Such signs are used to denote parts of a page that should be managed as images, links, scripts, etc.
The XSS Bug in Photos.Facebook.com
What did fin1te find? The researcher found a way to create a URL on photos.facebook.com, redirected to allocate his specially crafted file from the content delivery network (CDN). In other words, he succeeded in uploading a hidden script to the CDN, and retrieving it with the help of an innocently masqueraded link.
Once clicked by a user, the script would run in the browser like it was an official Facebook script. If the user is logged in, the crafted script could do practically anything the user would do – post messages, photos, get access to private data, etc.
Having in mind how a social network works, such scripts could easily go viral, in a negative aspect. That is why an attack involving an XSS bug could be referred to as a worm-like threat. It can be deployed to spread itself automatically across any network, thus turning into a network worm or virus.
The XSS bug was fixed almost immediately after the researcher reported it to Facebook. Nonetheless, he waited half a year to make it public so that Facebook security engineers have enough time to implement a better solution. He was awarded $7500.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: