4

Facebook discovered a "security issue" affecting 50 million accounts. According to Facebook,

This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts.

I searched but couldn't find anything on how to access a Facebook account if you know the access token, so I couldn't understand this security issue. Can anyone tell me how a hacker can access a Facebook account if they know the access token?

  • The following 2 links, explain in-depth about how a hacker can access Facebook account if they know the access token: Link 1 Link 2 – user3382203 Oct 2 '18 at 6:32
  • @user3382203 Thanks for the two links. I read both articles, but it didn't answer the my question... Those article also said, “It’s important to say: the attackers could use the account as if they were the account holder,” My problem is how? In simply, if I know the your access token, how can I use your account as I am the account holder – I am the Most Stupid Person Oct 2 '18 at 6:42
  • Are you familiar with session management and single-sign on? – Silver Oct 2 '18 at 7:40
  • @Silver Yes, but not an expert. I am reading your answer now. – I am the Most Stupid Person Oct 2 '18 at 12:06
2

What I find unclear is HOW they stole access token and what the video upload functionality has to do with it.

But that is not your question. You want to know how an access token provides access to the account of another user. This requires some knowledge on how a website authenticates you and gives you access. Session management explained here.

In a normal flow, you authenticate using a password, bio-metrics, etc. In exchange for a valid authentication, you receive a session id which is often stored in a cookie. For every other request, you add this session ID to prove that you are the same user as then one who authenticated successfully. An access token is basically a session identifier. It is provided to a user after successful authentication. The token can have a certain privilege level attached to it. This allows you to get a low privilege access token when using weak authentication such as password, or a high privilege access token when using stronger authentication such as bio-metrics. Probably, the view-as functionality provides you with an access token for a user other than yourself (the person you are viewing as). Due to some bug (unclear to me as well), this access token can be attached to other requests and result in a successful response.

Normal flow:

  1. I authenticate.
  2. I get an access token.
  3. I fetch my profile and attach my access token as proof that I am the person who authenticated.
  4. I receive my profile information.

Attack flow: 1. I view as my target user. 2. I somehow receive an access token for this target user. 3. I fetch 'my profile' but use the access token of my target user. 4. I receive the profile info of the target user.

The entire concept of tokens, SSO, session is more complex and I cut some corners. A session identifier often refers to a piece of information on the server which feeds access control with user attributes to base access control decisions on. An access token is often self contained, meaning it holds the user attributes possibly encrypted and signed.

1

An attacker with your access token would need to build their own client to present that token to the Facebook servers.

An attacker with a lot of tokens would likely build a program that acted as multiple clients at once, across multiple outgoing IPs, which would, after gaining access by reusing the compromised tokens, begin downloading everything they can, via the APIs that Facebook uses for it’s own client applications.

They could also theoretically post, chat, and trigger other actions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.