Facebook may have the largest database of photos. Every day, about 350 photos are coming from around the world.
The security researcher Laxman Muthiyah he discovered a way that he could if he wished to delete every photo that has gone up to the popular social network.
Fortunately for it Facebook and 1,3 billion users, researcher Laxman Muthiyah had no malicious aspirations. He reported the error on Facebook, and won 12500 dollars.
The response from Facebook was immediate - to their credit, and the error was fixed across the network within 2 hours.
Laxman says:
OMG :D the album got deleted! So i got the key to delete all of your Facebook beautiful photos :P lol :D
Immediately reported this bug to Facebok security team. They were too fast in identifying this issue and there was a fix in place in less than 2 hours from the acknowledgment of the report.
Of course, Laxman had other options.
The error he discovered is a weapon. He could not kill anyone, but he could make miserable hundreds of millions of people.
Laxman would probably have put the bug in the underground market and earned a lot more money than he got from Facebok.
Or he could have kept his discovery a secret and exploited it himself for his own benefit, see LizardSquad. Do you think if they had discovered her vulnerability would LizardSquad announce her on Facebook?
Laxman discovered the error while looking at the API's Graph API (Application Program Interface).
The Graph API helps connect Facebook with websites, apps, and moreletterthose that need to integrate with Facebook.
He is a frugal, code interface directed by HTTP requests. It allows apps to do the same things Facebook users do, and more.
Of course, API users should not be able to process or delete things belonging to someone else.
What Laxman discovered was a bug that allowed him to do just that, using an access token of the Facebook app for Android to authenticate himself.
The Facebook vulnerability was nothing more than four lines code:
Host: graph.facebook.com
Content-Length: 245
Facebok's album IDs are numeric, which means that someone can start from 1 and just keep going until nothing is left. Or even faster, the hacker could create a script with the above code in a loop, starting from 1 up to one trillion.
Guess the result.
See PoC