Facebook discovered a "security issue" affecting 50 million accounts. According to Facebook,
This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts.
I searched but couldn't find anything on how to access a Facebook account if you know the access token, so I couldn't understand this security issue. Can anyone tell me how a hacker can access a Facebook account if they know the access token?
What I find unclear is HOW they stole access token and what the video upload functionality has to do with it.
But that is not your question. You want to know how an access token provides access to the account of another user. This requires some knowledge on how a website authenticates you and gives you access. Session management explained here.
In a normal flow, you authenticate using a password, bio-metrics, etc. In exchange for a valid authentication, you receive a session id which is often stored in a cookie. For every other request, you add this session ID to prove that you are the same user as then one who authenticated successfully. An access token is basically a session identifier. It is provided to a user after successful authentication. The token can have a certain privilege level attached to it. This allows you to get a low privilege access token when using weak authentication such as password, or a high privilege access token when using stronger authentication such as bio-metrics. Probably, the view-as functionality provides you with an access token for a user other than yourself (the person you are viewing as). Due to some bug (unclear to me as well), this access token can be attached to other requests and result in a successful response.
Normal flow:
Attack flow: 1. I view as my target user. 2. I somehow receive an access token for this target user. 3. I fetch 'my profile' but use the access token of my target user. 4. I receive the profile info of the target user.
The entire concept of tokens, SSO, session is more complex and I cut some corners. A session identifier often refers to a piece of information on the server which feeds access control with user attributes to base access control decisions on. An access token is often self contained, meaning it holds the user attributes possibly encrypted and signed.
An attacker with your access token would need to build their own client to present that token to the Facebook servers.
An attacker with a lot of tokens would likely build a program that acted as multiple clients at once, across multiple outgoing IPs, which would, after gaining access by reusing the compromised tokens, begin downloading everything they can, via the APIs that Facebook uses for it’s own client applications.
They could also theoretically post, chat, and trigger other actions.
