Facebook is the largest social networking website on earth, that is being used by every almost every internet user, and Of course if using facebook, then also you are using login with facebook function somewhere on a website or for an app, but now its time to revoke them all now, as they a new vulnerability found in the Facebook SDK that put users’ authentication token at risk.
The Vulnerability allows an attacker to steal users’ authentication token and use them to login in his/her account, and can steal information, post anything on your behalf.
Roll of Facebook Auth Tokens or Login as Facebook:
First, we start from a website somewhere on a web, which has a Login with Facebook function, that many websites have right now, as you can see in the image below:
So, the Login with Facebook function allows third party to login into their app or websites through your information on Facebook and after just you login with facebook an a website or app, then device will store your access token and other information in unencrypted format, which can be easily accessed by an attacker in just 5 seconds.
5 Seconds sound amazing and scary too :)
This Vulnerability found by Security researchers from MetaIntell, the leader in intelligent led Mobile Risk Management (MRM.)
The 5 Second talk was said by researchers in a talk with the hacker news, they said:
“With just 5 seconds of USB connectivity, Access token is available on iOS via juice jacking attack, no jailbreak needed and on Android file system, it can be accessed via recovery mode which is tricker and require more time.”
If your access tokens and other information stored on your device, so it can be also stolen by other apps that have permission to access your file system.
Researchers also published a video, how they able to steal Facebook Auth Token from VIBER:
If you are a facebook user and allowed apps and website logins through your facebook account, so now you should revoke all of them, as this exploit has came into public and anyone can use this method to hijack your facebook account.
This Vulnerability dubbed as “Social Login Session Hijacking” by researchers.
Meet the Researchers :)