A smart Facebook hack allowed to retrieve the private email address of any user. The issue was discovered by the hacker Tommy DeVoss who awarded with $5,000 under the Facebook Bug bounty program.
“The hack allowed me to harvest as many email addresses as I wanted from anybody on Facebook,” DeVoss said. “It didn’t matter how private you thought your email address was – I could of grabbed it.”
The expert discovered the vulnerability on Thanksgiving Day and reported it Facebook via its bug bounty program.
The issue resides in the user-generated Facebook Groups feature that allows any member to create an affinity group. The administrator of a Facebook Group could invite any Facebook member to have admin roles, the invitation is handled by Facebook and sent to the member’s Facebook Messages inbox. The invitation is also sent to the email address associated with invited member’s account. DeVoss discovered that even when users decide to keep their email address private he was able to discover it.
The expert discovered the problem when he canceled pending invitations. He switched to Facebook’s mobile view of the Page Roles tab from which he was able to view the full email addresses of anyone he wanted to cancel from becoming a Facebook Group Administrator.
“While Facebook waits for the confirmation, the user is forwarded to a Page Roles tab that includes a button to cancel the request,” he explained in a blog post.
“I noticed that when you clicked to cancel the administrator invitation on the mobile page, you were redirected to a page with the email address in the URL,” he said. “Now all you have to do is pluck the plaintext version of the confidential email address straight from the URL.”
Clicking on the remove invitation link on the mobile page, the expert was redirected to a page with the following URL:
The above URL will reveal the private email of the invited user in the parameter ‘removependinginvite_email’.
This Facebook hack could have a serious impact on the user privacy, threat actors could be interested in collecting the private email addresses to conduct a wide range of malicious activities.
(Security Affairs – Facebook hack, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.