full-disclosure - Re: Facebook name extraction based on email/wrong password + POC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTimaHz1KzOLWO4XuHV9GM+MWA2VDOso+LKzB6HWG@mail.gmail.com>
Date: Wed, 11 Aug 2010 19:50:10 +0530
From: Atul Agarwal <atul@...fence.com>
To: Kevin Connolly <bugtwak@...il.com>
Subject: Re: Facebook name extraction based on email/wrong
	password + POC

Never encountered that, nevertheless excellent find!

Would check it and would incorporate that in the script!

Thanks,
Atul Agarwal
Secfence Technologies
www.secfence.com



On Wed, Aug 11, 2010 at 7:41 PM, Kevin Connolly <bugtwak@...il.com> wrote:

> It gets better. If you enter an e-mail address that is close but not
> exactly right then Facebook will "correct it for you"
>
> <<<
> Fixed Misspelling
>
> It looks like you entered a slight misspelling of your email or username.
> Please re-enter your password. >>>
>
>
> and it displays the "corrected" e-mail address in the login box :-)
>
>
>
> On Wed, Aug 11, 2010 at 10:01 AM, Atul Agarwal <atul@...fence.com> wrote:
>
>> Hello all,
>>
>> Sometime back, I noticed a strange problem with Facebook, I had
>> accidentally entered wrong password in Facebook, and it showed my first and
>> last name with profile picture, along with the password incorrect message. I
>> thought that the fact that it was showing the name had something to do with
>> cookies stored, so I tried other email id's, and it was the same. I wondered
>> over the possibilities, and wrote a POC tool to test it.
>>
>> This script extracts the First and Last Name (provided by the users when
>> they sign up for Facebook). Facebook is kind enough to return the name even
>> if the supplied email/password combination is wrong. Further more,it also
>> gives out the profile picture (this script does not harvest it, but its easy
>> to add that too). Facebook users have no control over this, as this works
>> even when you have set all privacy settings properly. Harvesting this data
>> is very easy, as it can be easily bypassed by using a bunch of proxies.
>>
>> As Facebook is so popular, some implications -
>>
>> 1) Someone has a list of email address that he has no clue about. He can
>> feed them to Facebook one by one (or in a list, using a script like this)
>> and chances are that he'll get more than 50% hits. Useful for phishing
>> attacks (People will get more convinced when they see their *real* names).
>>
>> 2) One can generate random email addresses, and *verify* their existence .
>> Hint: You can generate emails using (common names + a corporate domain), and
>> check them against Facebook. Might come handy in a Pentest.
>>
>> Rest is only left up to one's imagination.
>>
>> Find the POC script attached.
>>
>> PS: I did not report this, as I am unsure on what to call it, a "bug",
>> "vuln" or a "feature".
>>
>> Thanks,
>> Atul Agarwal
>> Secfence Technologies
>> www.secfence.com
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/