![]() The above URL will reveal the private email of the invited user in the parameter ‘removependinginvite_email’. “Now all you have to do is pluck the plaintext version of the confidential email address straight from the URL.”Ĭlicking on the remove invitation link on the mobile page, the expert was redirected to a page with the following URL: “I noticed that when you clicked to cancel the administrator invitation on the mobile page, you were redirected to a page with the email address in the URL,” he said. “While Facebook waits for the confirmation, the user is forwarded to a Page Roles tab that includes a button to cancel the request,” he explained in a blog post. He switched to Facebook’s mobile view of the Page Roles tab from which he was able to view the full email addresses of anyone he wanted to cancel from becoming a Facebook Group Administrator. The expert discovered the problem when he canceled pending invitations. DeVoss discovered that even when users decide to keep their email address private he was able to discover it. The invitation is also sent to the email address associated with invited member’s account. The administrator of a Facebook Group could invite any Facebook member to have admin roles, the invitation is handled by Facebook and sent to the member’s Facebook Messages inbox. The issue resides in the user-generated Facebook Groups feature that allows any member to create an affinity group. The expert discovered the vulnerability on Thanksgiving Day and reported it Facebook via its bug bounty program. “It didn’t matter how private you thought your email address was – I could of grabbed it.” “The hack allowed me to harvest as many email addresses as I wanted from anybody on Facebook,” DeVoss said. The issue was discovered by the hacker Tommy DeVoss who awarded with $5,000 under the Facebook Bug bounty program. A Facebook hack could have been exploited to retrieve the private email address of any user with a serious impact on the privacy.Ī smart Facebook hack allowed to retrieve the private email address of any user. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |