E-Business
Cyberoam says Flaws in Facebook Authorization May Trigger Attacks
Cyberoam, leading global network security Appliances Company, said it found a critical flaw in Facebook’s access token authorization mechanism.
Cyberoam’s Threat Research Labs (CTRL) (CTRL) found this vulnerability while investigating an ongoing Facebook spam ‘lady with razor-sharp axe’.
Vulnerability researchers at CTRL reveal this security flaw allows attackers to perform a range of malicious activities such as uploading photos and videos, posting comments, pay with Facebook, publish content, and send SMS, read mailbox, tag friends’ photos and more. With this, an attacker is able to perform nearly every task which a Facebook user can do and hence allows various malicious actions.
“Ongoing Facebook spams such as ‘lady with razor-sharp axe’ tend to store stolen Facebook access tokens on their servers for further attacks or exploits. This attack is not limited only to tagging or uploading of photos. Upon clicking the link, Facebook users are unwittingly handing over complete access to their Facebook account, which remains available to attackers even after an affected user logs out from Facebook account”, said Bhadresh Patel, lead vulnerability researcher at CTRL.
Findings from CTRL identify a security vulnerability that allows cyber attackers to bypass Facebook’s Access Token Authorization mechanism. This entitles cyber attackers to generate unauthorized yet valid access tokens. CTRL has already reported this vulnerability to Facebook and extensive investigation from CTRL would be revealed upon suitable reciprocation or release of security patch from Facebook.
Jitendra Bulani in-charge of media relations at Cyberoam told Nigeria CommunicationsWeek that Cyberoam Threat Research Labs (CTRL) identifies security threats and protects Cyberoam customers against various vulnerabilities such as malware attacks by publishing security upgrade and research reports.
Such reports help Cyberoam customers remain protected with detailed guidance and malware threat prevention advice using appropriate configuration of parameters on Cyberoam appliances. During the last year, CTRL had researched over 138 vulnerabilities and released suitable signatures protection for extending appropriate security protection to customers.