Facebook plugs email address hole

By on
Facebook plugs email address hole

A Facebook vulnerability that revealed a number of primary email addresses was discovered and detailed by a bug bounty hunter.

Programmer, web developer and bug bounty hunter Roy Castillo discovered a glitch in Facebook late last month that will expose any email address without user interaction – and despite the privacy setting.

The flaw resided in Facebook's app development tools which allowed app administrators have the ability to add information for developers. In this instance, the primary email address for any unverified Facebook user would be revealed if added as a developer.

Numerical Facebook user IDs could be collected through Facebook's People Directory and dumped into the developer profile page to generate an error message containing the users' primary email address, regardless of their privacy settings.

Castillo was able to reproduce the result by simply blocking an account, and then by adding more parameters, obtaining a list containing multiple email addresses at once.

He discovered the vulnerability on 25 June and was paid $4500. The flaw was fixed in six hours.

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition

Most Read Articles

Log In

  |  Forgot your password?