If you don’t know what someone’s numeric profile ID is, you can always look it up using freely-available tools – they aren’t supposed to be a secret. Therefore, the first step needed to hijack someone’s account in this way requires your victim’s unique Facebook profile ID. That’s the unique number associated with your intended target’s account.Ĭhange the profile ID that is sent by that form to Facebook, and the social network might be duped into thinking you are someone else linking a mobile phone to their account. What fin1te had uncovered was that one of the elements of the mobile activation form contained, as a parameter, the user’s profile ID. The normal sequence of events would be to enter that confirmation code into a Facebook form, and go on your merry way…īut fin1te discovered that a vulnerability existed on that form, that could be exploited to use the confirmation code he had been sent by Facebook via SMS with *anyone* else’s account.
In the UK, the SMS shortcode for Facebook is 32665.įacebook responds, via SMS, with an eight character confirmation code.
The first thing to do is send the letter “F” in an SMS message to Facebook, as though you were legitimately registering your mobile phone with the social network. This should – obviously – have been impossible, but due to a weakness in Facebook’s tangled nest of millions and millions of lines in code, potentially hundreds of millions of accounts were vulnerable to hijacking through the simple technique.įin1te (real name Jack Whitten) has documented how the hack works on his blog. A UK-based security researcher going by the name of “fin1te” has earned himself $20,000 after uncovering a way to hack into any account on Facebook, just by sending a mobile phone text message.
0 kommentar(er)
