A minor bug that enables anyone to manipulate the life events of any user has been just reported by the independent bug hunter Sachin Thakuri. Even though it’s not of technical or security nature, the bug can be blamed for some distress. It could be employed by bad actors and could cause moral damage at the very least.
Facebook refused to fix the bug
Interestingly enough, the researcher claims that he has contacted Facebook, but they decided not to fix it. Even though it’s not malicious, it could still be quite damaging to Facebook users, and it’s weird the company has chosen to leave it hanging like that.
Here’s how Sachin discovered the bug
For research purposes, he used the original URL of Mark Zuckerberg’s life event.
Then, he removed the ‘ustart=1 parameter’.
Clicking on the above manipulated URL will show the same life event page of Mark Zuckerberg, but with a ‘slight’ difference in the text:
Left Job at Facebook instead displaying Started Working at Facebook.
We’ll see how long it will take for scammers to find the bug themselves and exploit it for whatever reasons they may have.
More Facebook Scams to Keep Away from:
Facebook Dislike Button Scam
Facebook Change Color Virus
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: