• Gak pakai ribet loh....
  • Luangkan waktu Anda 5 menit untuk sukses
  • Sangat mudah, dijamin
  • Long Live With Delphi

Selasa, 16 Juli 2013

Hack Facebook dalam satu ( 1 ) menit!

Security expert Dan Melamed discovered a critical vulnerability in Facebook platform that allow an attacker to take complete control over any account


the vulnerability is considered critical because it would allow a hacker to hack potentially any Facebook account. Dan Melamed presented the discovery on his blog. Dan demonstrated that how a hacker can reset the victim's account password just by tricking him to visit a malicious exploit code. The flaw affects the Facebook " claim email address " component. When an user tries to add an email address already registered to Facebook platform, he has the option to " claim it ". The loophole exists here, when user claim an email address, Facebook did not check from whom the request came from. This allows an email to be claimed on any Facebook account. 

The exploit is possible provided that :
An existing account having the email address that the attacker wants to claim.
Another existing account to initiate the claim process


When user makes a claim request for an @hotmail.com email he is taken to a link that appears like this: https://www.facebook.com/support/openid/proxy_hotmail.php?appdata[fbid]=AQ3Tcly2XEfbzuCqyhZXfb8_hYHTnHPPd-CDsvdrLzDnWLpsKTMcaXtIzV0qywEwbPs
The researcher discovered that the parameter  appdata[fbid] was the encrypted email address. Dan used the encrypted email funnyluv196@hotmail.com  for the POC. The link will redirect user to the sign in page for Hotmail.

You must sign in with the email address that matches the encrypted parameter. Once signed in, you are taken to a final link that looks like this:

https://www.facebook.com/support/openid/accept_hotmail.php?appdata=%7B%22fbid%22%3A%22AQ3Tcly2XEfbzuCqyhZXfb8_hYHTnHPPd-CDsvdrLzDnWLpsKTMcaXtIzV0qywEwbPs%22%7D&code=a6893043-cf19-942b-c686-1aadb8b21026 The source code confirms that the claim email process has succeeded: https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmW84I9B-UUdqRhlYG5WsFJPqYvNQ3O7CIDDex4GN1EZqIeBlcFOhY62-6j7uV17wJiZaXZXqAzIzeHIKGTZZZjotK3ydyr_z_1tHBa_8ZitnjPqW0RCb1JRbvBSZK9I5gBMKKsuEKphez/s1600/hacking_facebook_code.png
Once clicked, the email (in this case: funnyluv196@hotmail.com) is instantly added to their Facebook account. The victim does not receive any notification whatsoever that this email has been added. The hacker can then reset the victim's password using the newly added email address. Thus allowing the attacker to take complete control over the Facebook account.
This vulnerability has been confirmed to be patched by the Facebook Security Team, fortunately the group is very responsive as demonstrated for the be considered that the popular social networking platform is very attractive for cybercrime and many other categories of attackers, cyber security is a critical aspect for its business success.

5 komentar:

  1. These are truly enormous ideas in regarding blogging.
    You have touched some good points here. Any way keep up wrinting.


    Look into my web-site - cenaless funciona

    BalasHapus
  2. Hi there to all, how is all, I think every one is getting more from this website, and your views are good in support of new people.


    Check out my website ... google (google.com)

    BalasHapus
  3. What i don't understood is if truth be told how you're
    not really much more neatly-preferred than you may
    be now. You are so intelligent. You already know thus considerably in terms of this topic,
    made me individually consider it from a lot of varied angles.

    Its like men and women aren't involved until it's one thing to
    do with Lady gaga! Your personal stuffs excellent. All the
    time handle it up!

    Feel free to surf to my page - thyroid natural cures - http://www.sbwire.com/press-releases/hypothyroidism-treatment/sbwire-482368.htm -

    BalasHapus
  4. By this time, the urge for this to be over was almost too much for me tolerate.
    Epi-LASIK is a good option for people with too little corneal tissue to make a good LASIK flap.
    PRK is also referred many times as surface ablation and is accepted as just about the most popular
    eye medical procedures options.

    Feel free to visit my page - london vision

    BalasHapus
  5. Players have been in handle of cooking pizzas and earning
    enough money to come out ahead against their
    competitors. Others increase the social enhancing content for example forums, downloads and games cheat on their visitors.
    You look for your item as if you were searching
    on any internet search engine, once you see your item, just click
    about it along with the download will start. Perhaps the 1st great strategy
    game was Hammurabi (or Kingdom) which created a big splash within the 1970s.
    With new websites offering free games coming online each day, the games lovers are spoilt for choice.
    Many people nowadays begin with a sense of guilt
    whenever they take a look at on-line games. This game could be performed
    by one player, or it could possibly be played through
    LAN and perhaps by way of net multi player. So, if anyone has bored of playing those shooting
    games and racing games, then strategy games would be a nice
    breakout. Strategy games games are also capable of release stress and tension. Finally you'll receive an excellent siege weapon to actually just burn things on the
    ground. The games have attracted a variety of fans ever since
    they were invented. War Strategy Games aren't actually about war,
    however, these games tend to be regarding approach.
    Furthermore, there are some gaming websites which are tailored for offering a variety of games in nearly every genre.
    In case your strategy is determined by Reds & Blacks betting or Martingale progression then a best
    choice is going to be Red & Black Roulette Systems Studio.
    There are a lot of games that have used historic images and scenes already but it would
    not fail if you are able to put it to use again but on this
    occasion having a twist into something odd and extraordinary.
    Each soul features its own talent tree and you'll be able to just have 3 souls active
    during a period, but this is how that big difference is, you are
    able to train all the souls for you're class on the class trainer and it is possible
    to reset you're souls when ever. A regular bingo could
    be the completing one line as well as and three line games are special games.
    There are various flash game versions readily available for football,
    basketball, cricket, tennis, golf, billiards, chess,
    car racing, F1, shooting, hockey, beach volleyball,
    etc. What it WILL be can be a guide to making an extremely, very decent living doing that which you already love.
    Apple fashioned and yet redefined the place inside market using the launch of i - Phone and soon i -
    Phone was the talk from the town, with the highest ranking inside the charts, captivating the hearts immediately right from the very start.
    People can get sweets, clothes, upholsteries,
    groceries anything just by sitting at home. I couldn't trust how
    closely, the trial version was predicting when I
    should bet. Some in the games are really exciting that kids normally keep using it,
    for continuously 10 hours. You also can put talent
    points into any from the soul trees that you simply choose.
    Ninja Town also includes a nice multiplayer mode that lets players defend their particular town and whoever defeats every one of
    waves of demons first could be the winner.

    Also visit my weblog :: csi hidden crimes cheats

    BalasHapus

Mohon memberi komentar dan masukannya ya,

Related Posts Plugin for WordPress, Blogger...