Jump to content

Recommended Posts

  • FPCH Admin
Posted

A hacker in India has revealed how he found a way to break into any Facebook user’s profile, before alerting the social network to the issue and being rewarded for his work.

 

Anand Prakash is a security engineer in Bangalore who posted to his blog a piece entitled “How I could have hacked all Facebook accounts”, which detailed how he had discovered a way to exploit the ‘forgot password?’ section of the site and force his way into any account.

 

8b9dd5037c3725eb2beb2b0dc2ce1d5f.jpg

(Screenshot)

The forgotten password section of Facebook works as follows: if you forget your log-in, the site will email or text you a verification code in order to gain access to your profile. In order to protect this process from hackers, Facebook places what is known as rate-limiting on the codes, meaning that you have a limited number of chances to input the code Facebook sends you.

 

This prevents hackers using what’s known as a brute-force attack, using software to continuously enter numbers until it gets the right one.

 

What Prakash discovered was that Facebook beta sites did not in fact have the rate-limiting feature in place, so you had an infinite number of chances to try to log-in. This is how Prakash got in.

 

4d6a760a5734dfe06071f35a80da1fa5.jpg

(Chris Ison/PA)

The fallout if this were to happen for real is potentially immense when you think of the amount of detail that is stored on your Facebook profile – in many cases it includes payment information.

 

Having discovered the weakness, Prakash says he reported it to Facebook on February 22. On March 2, he was awarded $15,000 (£10,500) by the social network for his troubles.

 

Facebook has not officially confirmed the incident, though images from Prakash’s blog suggest communication took place, and similar rewards have been handed out in the past.

 

Source: yahoo

~I know that you believe you understand what you think I said, but I'm not sure you realize that what you heard is not what I meant.~

~~Robert McCloskey~~

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...