We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
 
74,421 News Articles

Researcher: Face.com iOS flaw could have allowed Facebook, Twitter account hijacking

Face.com patched a vulnerability that could have allowed attackers to hijack the Facebook and Twitter accounts of its customers

Facial recognition start-up Face.com patched a vulnerability in its KLINK iOS app that could have allowed attackers to hijack the Facebook and Twitter accounts of its users, according to Ashkan Soltani, the independent security researcher who claims to have found the flaw.

KLIK is a camera app designed to allow users to easily tag friends in new photos by scanning their Facebook photo albums. It uses facial recognition technology developed by Face.com.

In order to use the app, users need to grant it access to their Facebook accounts. However, the app can also be integrated with Twitter, where it can post messages on their behalf.

A simple vulnerability in the app allowed users to access each others' Facebook and Twitter accounts, Soltani said in a blog post on Monday, the same day Face.com announced that it had been acquired by Facebook.

The vulnerability was caused by Face.com storing Facebook and Twitter OAuth tokens -- unique authentication keys -- on its servers in an insecure way that made them accessible to anyone, Soltani said.

With access to users' OAuth tokens, an attacker could abuse the KLIK app's permissions on their accounts. This includes the ability to access their private photos and friend lists or to post status updates and tweets in their names.

Since the vulnerability affected facial recognition technology, the privacy implications were significant, Soltani said. An attacker could hijack a popular user's account -- like Lady Gaga's, had she used KLINK -- and build face prints for their millions of Facebook friends. Then they could match those in real time to people walking down the street.

"Since this was a vulnerability that could potentially reveal sensitive consumer information, I worked with Face.com, Facebook, and Twitter to make sure it was addressed before disclosing it," Soltani said.

"We can confirm that on Friday, June 15th, a security vulnerability was pointed out to us," a Face.com spokesman said via email. "The problem was resolved within an hour after being reported and the issue is now fixed. No users were affected, nor was any private information disclosed."


IDG UK Sites

LG G3 release date, price, specs and new features 2014

IDG UK Sites

iPhone 5s review: why the iPhone 5s is still the best phone you can buy in 2014

IDG UK Sites

PCs vs consoles: PCs still pwn when it comes to gaming (and everything else)

IDG UK Sites

NAB 2014: Affordable 4K cameras, boundary-pushing plug-ins & drone domination