Nir Goldshlager reveals how to hack Facebook Apps

By Pierluigi Paganini, Editor-in-Chief, CDM

May 21, 2013, 11:30 am EST

The popular security expert Nir Goldshlager found  a serious vulnerability that allows attackers to post spoofed messages from any application on Facebook.

Facebook has many vulnerabilities exactly as any other software and daily hackers try to exploit them, the primary concerns of security experts are related to flaws in the popular social network that could all allow attackers to inject external malicious links or images to the Facebook bulletin board.

Using injection techniques the attackers could elude security mechanisms and hijack a Facebook account with serious repercussion on user’s privacy.

The popular security expert Nir Goldshlager, Founder/CEO of Break Security, found a serious vulnerability that allows attacker to post spoofed messages from any application on Facebook such as Spotify, Skype and Pinterest.

The vulnerability is still unfixed today and it makes possible data spoofing from any Facebook app.

Let’s step to 2012 analyzing the method used by Facebook to publish content on the wall called stream.publish, the Stream Publish Dialog has the following format:

https://www.facebook.com/dialog/stream.publish?app_id=xxxx&redirect_uri=http://www.facebook.com/&action_links=&attachment=%7B%27media%27:%20[%7B%27type%27:%20%27flash%27,%27swfsrc%27:%27http://files.nirgoldshlager.com/goldshlager2.swf%27,%27imgsrc%27:%27http://www.vectorstock.com/i/composite/41,30/hacked-pc-vector-194130.jpg%27,%27width%27:%27130%27,%27height%27:%27%20130%27,%27expanded_width%27:%27500%27,%27expanded_%20height%27:%27500%27%7D],%27name%27:%27xxxx%27,%27caption%27:%27xxxx%20Application%27,%27properties%27:%7B%27xxx%27:%7B%27text%27:%27Download%20xxx%27,%27href%27:%27http://nirgoldshlager.com%27%7D%7D%7D

A hacker could manipulate the  app_id and attachment (swfsr,imgsrc,href) parameters to conduct an attack. If the “Stream post URL security” option is disabled by the author of that application, a hacker can upload specifically crafted content, like a swf file, as attachment parameter.

App security

In the post on the Break security web site is reported:

Every time a victim visits my wall post, they will see content spoofing from a Facebook application that they generally trust. Clicking the link on the post makes an swf file from the external website execute on his client machine.

In 2013 the situation is changed, Facebook eliminated the stream.publish option, instead opting for a Feed Dialog to publish app activity.

Nir Goldshlager has not lost his nerve and analyzed the Feed Dialog and the parameters used to spoof app content.

Following the details of parameters used in Feed Dialog

  1. Link parameter: With this parameter, we will include our malicious external link (virus exe file, 0days, Phishing site, or any other malicious link. 
  2. Picture Parameter: This parameter is only usable if we want to spoof the content with an image. The content of the image will only display correctly on our Wall post. It will not display correctly in the newsfeed, making it relevant only to wall post app spoofing.
  3. Caption Parameter: This parameter will allow to an attacker choose from which website the content came from, For Example: Facebook.com Zynga.com Ownerappdomain.com
  4. Name Parameter: This parameter produces the title we desire. Whenever the victim clicks on that title, he will be taken to our malicious website.

The post proposes a proof of concept video that present the Facebook hack for some various applications such as Skype and SoundCloud.

FB 2

FB 3

SoundCloud:

https://www.facebook.com/dialog/feed?app_id=19507961798&link=http://nmap.org/dist/nmap-6.20BETA1-setup.exe&picture=http://www.atpfestival.com/assets/img/soundcloud.png&name=Download%20SoundCloud%20For%20Windows&%20caption=http://soundcloud.com&description=&%20redirect_uri=https://facebook.com

Skype:

https://www.facebook.com/dialog/feed?app_id=260273468396&link= https://touch.facebook.com/apps/sdfsdsdsgs &picture=http://he.downloadastro.com/static/files/24/3b/29/243b29a6163cc99e359f4c354422f238.jpg&name=Download%20Skype%20New%20Version&%20caption=http://skype.com&description=&%20redirect_uri=https://facebook.com

 The author suggests the following solutions to solve the problem:

  • Use Stream post URL security=Enabled in App settings (developers.facebook.com), To prevent  content spoofing on your App.
  • Use Bonus Video (Advanced Spoofing Apps Links, Fixed By Facebook Security 2012)
  • Use  Stream post URL security=Enabled

The flaws discovered by Goldshlager allow cyber criminals to spoof the content of any Facebook application, they could adopt the technique of attack to install malicious code on the user’s machine or deceive user with social engineering attack.

(Source: CDM & Security Affairs – Hacking)

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2021

We are in our 9th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.

APPLY NOW