EVERYONE WANTS TO KNOW HOW TO HACK A FACEBOOK PAGE OR AN ACCOUNT BUT NO ONE WANTS TO DO THE HARD WORK — HERE’S AN INDIAN HACKER WHO FOUND A CRITICAL SECURITY FLAW IN FACEBOOK BUSINESS MANAGER ALLOWING HIM TO HACK ANY FACEBOOK PAGE WITHIN 10 SECONDS.
Arun Sureshkumar, an Indian IT security researcher exposed a critical vulnerability in Facebook business manager allowing attackers to take over any Facebook page – In return Facebook awarded Sureshkumar with 16,000 USD as part of the bug bounty program.
The issue discovered by hacker revolves around Insecure Direct Object Reference, also called IDOR. It refers to when a reference to an internal implementation object, such as a file or database key, is exposed to users without any other access control. In such cases, the attacker can manipulate those references to get access to unauthorized data. In Facebook’s case, IDOR vulnerability in Facebook Business Manager allowed him to take over any Facebook page in less than 10 seconds.
Business Manager actually lets businesses share and control access to their ad accounts, Pages, and other assets on Facebook. Anyone on a business page can see all of the Pages and ad accounts they work on in one place, without sharing login information or being connected to their coworkers on Facebook.
The researcher also mentioned that an attacker could even take over pages like Bill Gates, Narendra Modi , Barack Obama and do whatever kind of damage desired including deleting these pages.
Sureshkumar’s findings:
Sureshkumar made two Facebook business accounts, one as his own and the other for testing purposes. He then added a partner using his own ID and intercepted the request using Burp Suite. After that, he changed the parent business ID with agency ID and asset ID with the page ID he wanted to hack. Once done with changing IDs, the researcher requested manager role on the page.
In few seconds, Sureshkumar had admin rights on the target page thus allowing him to perform the actions he wanted through the business manager.
Also Read: Some social engineering skills and Facebook will gift your account to hackers
Watch how Sureshkumar was able to hack a Facebook page in no time at all:
https://youtu.be/BSnksWX5Kn0
Have you heard about programmed ATM card? email: (williamshackers@hotmail.com) for enquiring on how to get the ATM programmed card.
ReplyDeleteWe have special cash loaded programmed ATM card of $1000, $2000, $3000, $4000 and any amount your choice you need for you to buy your dream car, house and to start up your own business. Our ATM card can be used to withdraw cash at any ATM or swipe, stores and POS. Our card has daily withdrawal limit depending card balance you order. Contact us via Email if you need a card email: (williamshackers@hotmail.com)..