The popular security expert Nir Goldshlager found a serious vulnerability that allows attackers to post spoofed messages from any application on Facebook.
Facebook has many vulnerabilities exactly as any other software and daily hackers try to exploit them, the primary concerns of security experts are related to flaws in the popular social network that could all allow attackers to inject external malicious links or images to the Facebook bulletin board.
Using injection techniques the attackers could elude security mechanisms and hijack a Facebook account with serious repercussion on user’s privacy.
The popular security expert Nir Goldshlager, Founder/CEO of Break Security, found a serious vulnerability that allows attacker to post spoofed messages from any application on Facebook such as Spotify, Skype and Pinterest.
The vulnerability is still unfixed today and it makes possible data spoofing from any Facebook app.
Let’s step to 2012 analyzing the method used by Facebook to publish content on the wall called stream.publish, the Stream Publish Dialog has the following format:
https://www.facebook.com/dialog/stream.publish?app_id=xxxx&redirect_uri=http://www.facebook.com/&action_links=&attachment=%7B%27media%27:%20[%7B%27type%27:%20%27flash%27,%27swfsrc%27:%27http://files.nirgoldshlager.com/goldshlager2.swf%27,%27imgsrc%27:%27http://www.vectorstock.com/i/composite/41,30/hacked-pc-vector-194130.jpg%27,%27width%27:%27130%27,%27height%27:%27%20130%27,%27expanded_width%27:%27500%27,%27expanded_%20height%27:%27500%27%7D],%27name%27:%27xxxx%27,%27caption%27:%27xxxx%20Application%27,%27properties%27:%7B%27xxx%27:%7B%27text%27:%27Download%20xxx%27,%27href%27:%27http://nirgoldshlager.com%27%7D%7D%7D
A hacker could manipulate the app_id and attachment (swfsr,imgsrc,href) parameters to conduct an attack. If the “Stream post URL security” option is disabled by the author of that application, a hacker can upload specifically crafted content, like a swf file, as attachment parameter.
In the post on the Break security web site is reported:
“every time a victim visits my wall post, they will see content spoofing from a Facebook application that they generally trust. Clicking the link on the post makes an swf file from the external website execute on his client machine.“
In 2013 the situation is changed, Facebook eliminated the stream.publish option, instead opting for a Feed Dialog to publish app activity.
Nir Goldshlager has not lost his nerve and analyzed the Feed Dialog and the parameters used to spoof app content.
Following the details of parameters used in Feed Dialog
- Link parameter: With this parameter, we will include our malicious external link (virus exe file, 0days, Phishing site, or any other malicious link.
- Picture Parameter: This parameter is only usable if we want to spoof the content with an image. The content of the image will only display correctly on our Wall post. It will not display correctly in the newsfeed, making it relevant only to wall post app spoofing.
- Caption Parameter: This parameter will allow to an attacker choose from which website the content came from, For Example: Facebook.com Zynga.com Ownerappdomain.com
- Name Parameter: This parameter produces the title we desire. Whenever the victim clicks on that title, he will be taken to our malicious website.
The post proposes a proof of concept video that present the Facebook hack for some various applications such as Skype and SoundCloud.
SoundCloud:
https://www.facebook.com/dialog/feed?app_id=19507961798&link=http://nmap.org/dist/nmap-6.20BETA1-setup.exe&picture=http://www.atpfestival.com/assets/img/soundcloud.png&name=Download%20SoundCloud%20For%20Windows&%20caption=http://soundcloud.com&description=&%20redirect_uri=https://facebook.com
Skype:
https://www.facebook.com/dialog/feed?app_id=260273468396&link= https://touch.facebook.com/apps/sdfsdsdsgs &picture=http://he.downloadastro.com/static/files/24/3b/29/243b29a6163cc99e359f4c354422f238.jpg&name=Download%20Skype%20New%20Version&%20caption=http://skype.com&description=&%20redirect_uri=https://facebook.com
The author suggests the following solutions to solve the problem:
- Use Stream post URL security=Enabled in App settings (developers.facebook.com), To prevent content spoofing on your App.
- Use Bonus Video (Advanced Spoofing Apps Links, Fixed By Facebook Security 2012)
- Use Stream post URL security=Enabled
The flaw discovered by Goldshlager allow cyber criminals to spoof the content of any Facebook application, they could adopt the technique of attack to install malicious code on the user’s machine or deceive user with social engineering attack.
Pierluigi Paganini
(Security Affairs – Hacking)
Share On
