bugtraq - e-Sentinel Security Advisory - Ref: Session Hijacking iPhone Facebook Application ver 3.1.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100212005215.9807.qmail@securityfocus.com>
Date: 12 Feb 2010 00:52:15 -0000
From: bill.robson@...entinel.com
To: bugtraq@...urityfocus.com
Subject: e-Sentinel Security Advisory - Ref: Session Hijacking iPhone
 Facebook Application ver 3.1.2

Tested on
iPhone firmware version 3.1.2
Facebook App version 3.1.2

Impact
It is possible to usurp valid session IDs in order to gain unauthorised access to facebook profiles. At greatest risk are those handset that have been jailbroken.

Description
Using known vulnerabilities and exploits to gain remote or direct access to the handset's file system, it is possible to steal the files:

/private/var/mobile/Applications/<install directory>/Library/Preferences/com.facebook.Facebook.plist

/private/var/mobile/Applications/<install directory>/Library/Cookies/Cookies.plist

Once these files are copied and installed on to a separate handset, the attacker is able to use the victim's Facebook account unhindered.

Exploit
Known vulnerabilities exist in order to gain access to the iPhone's file system, after which no exploit code is required.

Workaround/Fix
No known fix is known. To lessen the risk of this occurring, users should avoid Jailbreaking their handsets.