Security Experts:

Facebook Awards $55,000 for Flaw That Could Lead to Account Hijacking

A researcher has earned $55,000 from Facebook for reporting a serious vulnerability that could have been exploited by hackers to steal access tokens and hijack accounts.

India-based researcher Amol Baikar discovered in December that the “Login with Facebook” feature, which allows users to log in to other websites with their Facebook account, was affected by a vulnerability.

Baikar found that an attacker could hijack the OAuth flow — the feature uses the OAuth 2.0 authorization protocol — and steal a user’s access tokens for apps that use the OAuth flow, such as Instagram and Oculus. For the attack to work, a hacker would have needed to convince the targeted user to visit a malicious website.

Facebook was informed about the vulnerability on December 16 and a patch was released within a week. However, the researcher found a way to bypass the patch and a more efficient fix was rolled out in mid-January.

Baikar said he received a total of $55,000 from Facebook for his initial report and the patch bypass. The researcher said this was the highest bounty paid out by the social media giant for a client-side account takeover vulnerability.

“We’ve fixed the issue and haven’t seen any evidence of abuse,” Facebook told SecurityWeek. “We’re grateful for this researcher’s help to keep our platform safe.”

The company said the flaw was introduced in May 2019 and it was patched in January by altering the restrictions for the OAuth flow and through a code fix designed to prevent communication with untrusted websites.

Facebook last year paid out a total of roughly $2.2 million through its bug bounty program, reaching nearly $10 million since the launch of its program in 2011.

Baikar has published a blog post describing the technical details of the vulnerability.

Related: CSRF Vulnerability in Facebook Earns Researcher $25,000

Related: GIF Attack on Facebook Messenger Earned Hacker $10,000

Related: Facebook Rushes to Patch Bug Exposing Page Admins

Related: Instagram Account Takeover Vulnerability Earns Hacker $30,000

view counter
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.