How a hacker could delete every Facebook photo


Facebook may have the largest database of photos. Every day, about 350 photos are coming from around the world.delete button Facebook

The security researcher Laxman Muthiyah he discovered a way that he could if he wished to delete every photo that has gone up to the popular social network.

Fortunately for it Facebook and 1,3 billion users, researcher Laxman Muthiyah had no malicious aspirations. He reported the error on Facebook, and won 12500 dollars.

The response from Facebook was immediate - to their credit, and the error was fixed across the network within 2 hours.

Laxman says:

OMG: D the album got deleted! So i got the key to delete all of your Facebook photos: P lol: D
Immediately reported this bug to Facebok security team. They were too fast in identifying this issue and there was a fix in place in less than 2 hours from the acknowledgment of the report.

Of course, Laxman had other options.

The error he discovered is a weapon. He could not kill anyone, but he could make miserable hundreds of millions of people.

Laxman would probably have put the bug in the underground market and earned a lot more money than he got from Facebok.

Or he could keep his discovery a secret and exploit it for his own benefit, see LizardSquad. Do you think if LizardSquad had discovered the vulnerability they would have reported it on Facebook?

Laxman discovered the error while looking at the API's Graph API (Application Program Interface).

The Graph API helps Facebok's interface with webpages, applications and other programs that need to be integrated with Facebook.

It is a simple, interface code that is driven by HTTP requests. Allows applications to do the same things that Facebok users do, but many more.

Of course, API users should not be able to process or delete things belonging to someone else.

What Laxman discovered was a bug that allowed him to do just that, using an access token of the Facebook app for Android to authenticate himself.

Facebook's vulnerability was nothing more than four lines of code:

DELETE / HTTP / 1.1
Host: graph.facebook.com
Content-Length: 245
access_token =

Facebok's album IDs are numeric, which means that someone can start from 1 and just keep going until nothing is left. Or even faster, the hacker could create a script with the above code in a loop, starting from 1 up to one trillion.

Guess the result.

See PoC

Registration in iGuRu.gr via Email

Enter your email to subscribe to the email notification service for new posts.


Read them Technology News from all over the world, with the validity of iGuRu.gr

Follow us on Google News iGuRu.gr at Google news