Facebook plugs email address hole

Programmer, web developer and bug bounty hunter Roy Castillo discovered a glitch in Facebook late last month that will expose any email address without user interaction – and despite the privacy setting.

The flaw resided in Facebook's app development tools which allowed app administrators have the ability to add information for developers. In this instance, the primary email address for any unverified Facebook user would be revealed if added as a developer.

Numerical Facebook user IDs could be collected through Facebook's People Directory and dumped into the developer profile page to generate an error message containing the users' primary email address, regardless of their privacy settings.

Castillo was able to reproduce the result by simply blocking an account, and then by adding more parameters, obtaining a list containing multiple email addresses at once.

He discovered the vulnerability on 25 June and was paid $4500. The flaw was fixed in six hours.

This article originally appeared at scmagazineus.com