white hat hacker

I am a passionate writer with a keen nose for the news and stories that matter. Sit back, relax and enjoy the tech ride with me as I take you into my own version of all things techie

Facebook paid a white hat hacker, also known as internet bugs hunter, $15000 for a pointing out a security flaw in Facebook accounts. This Facebook security flaw could potentially render Facebook accounts accessible to anybody who could exploit it. The ramifications of these are better imagined.

white hat hacker
Anand Prakash

Anand Prakash is the white hat hacker that got the windfall from Facebook. Anand actually goes by the title of Internet Security expert and works for Flipkart, an Indian owned e-commerce company founded in 2007. As a security consultant, Anand’s brief includes searching for security weakness(es) in websites and getting paid for his efforts. He is what is known in the tech world as a white hat hacker. They are hackers that use their findings to plug loop holes so that criminals or black hat hackers can’t exploit them.

The Facebook security flaw was  found in beta.facebook.com, a portal that is meant for developers to test new products before being released to Facebook for the public to use. Normally, Facebook sends a 6-digit PIN code through email or text message upon the receipt of a password reset from users. To prevent abuse of the system, Facebook allows only a limited number of reset attempts. But at the developer platform, Prakash discovered there is no limit to how many guesses a user can make.

white hat hackerThe hack here is simple. Since all Facebook accounts are also accessible through the beta platform; and since there are no limits to the number of guesses for wrong reset codes, all Prakash did was to flood the Facebook page with PIN codes until a random number opens the page. After receiving the payout from Facebook, Prakash talked about the issue in a blog post titled, ‘ [Responsible disclosure] How I could have hacked all Facebook’s accounts.

“This post is about a simple vulnerability found on Facebook which could have been used to hack into other user’s Facebook account easily without any user interaction. This gave me full access of another users account by setting a new password. I was able to view messages, his credit/debit cards stored under payment section, personal photos etc. Facebook acknowledged the issue promptly, fixed it and rewarded $15,000 USD considering the severity and impact of the vulnerability.”

He then went on to describe how he did it with a video to show the whole process:

“Whenever a user Forgets his password on Facebook, he has an option to reset the password by entering his phone number/ email address on https://www.facebook.com/login/identify?ctx=recover&lwv=110 ,Facebook will then send a 6 digit code on his phone number/email address which user has to enter in order to set a new password. I tried to brute the 6 digit code on www.facebook.com and was blocked after 10-12 invalid attempts.
Then i looked out for the same issue on beta.facebook.com and mbasic.beta.facebook.com and interestingly rate limiting was missing on forgot password endpoints. I tried to takeover my account ( as per Facebook’s policy you should not do any harm on any other users account) and was successful in setting new password for my account. I could then use the same password to login in the account.”

The payment for a white hat hacker is not unusual though. Every major company has what is called a bugs bounty program that aims to encourage hackers to seek out flaws in their websites and get paid for it. However, the high payment for a relatively easy to fix bug is because, bug bounties are valued according to how damaging the bug could be if exploited. The complexity of the problem is secondary.

In a widely circulated statement, Facebook said,

“One of the most valuable benefits of bug bounty programs is the ability to find problems even before they reach production. We’re happy to recognize and reward Anand for his excellent report.”

For a white hat hacker like Prakash, a good payday like this is the reason he enjoys spending hours on his PC looking for security flaws in major websites.


photo credits: twitter.com; leemunroe.com

Related Post

Come On, Will You Go Without Sharing This?

Leave a Reply

Your email address will not be published. Required fields are marked *