Facebook Privacy Flaw Gave Hacker Access To Every Single Account


You probably don’t know Nir Goldshlager, but he sure could have known you until recently. That’s because Nir discovered a major privacy flaw in Facebook’s OAuth, the system developers use to access all sorts of information every time you hit that little “allow” button. Nir gained access to virtually anyone’s entire Facebook account.

As the hacker explained on his site:

I found a way in to get full permissions (read inbox, outbox, manage pages, manage ads, read private photos, videos, etc.) over the victim account even without any installed apps on the victim account…

And the worst part? The victims wouldn’t even need to click “allow”, so they were expunged from the process entirely.

Just to clarify there is no need for any installed apps on the victim’s account, Even if the victim never allowed any application in his Facebook account, I could still be getting full permissions This bug works on any browser.

Fortunately, Facebook has already corrected the problem, but this does make Facebook’s incomprehensibly complex privacy rules that much more menacing for the inevitable holes we have yet to find. [Nir Goldshlager via Daily Dot]


The Cheapest NBN 50 Plans

It’s the most popular NBN speed in Australia for a reason. Here are the cheapest plans available.

At Gizmodo, we independently select and write about stuff we love and think you'll like too. We have affiliate and advertising partnerships, which means we may collect a share of sales or other compensation from the links on this page. BTW – prices are accurate and items in stock at the time of posting.