Menu
Facebook fixes flaw that could have let hackers delete photos

Facebook fixes flaw that could have let hackers delete photos

Facebook paid an outside developer US$12,500 for discovering the flaw

Privacy on Facebook

Privacy on Facebook

The speed at which Facebook responded to a reported security vulnerability shows how important photos have become to the site.

The vulnerability could have allowed hackers to delete photos. An outside developer discovered the vulnerability in Facebook's Graph API, the primary way for outside developers to build apps and software that tap into Facebook's data.

The developer, identifying himself as Laxman Muthiyah in a blog post published Thursday, said he was able to use a mobile access token for the API to delete photo albums that were not his.

He alerted Facebook to the vulnerability and Facebook reacted quickly, issuing a fix within two hours from acknowledgment of Muthiyah's report. Facebook also paid him US$12,500 through the company's bug bounty program.

More than two billion photos are shared daily across Facebook, CEO Mark Zuckerberg said last month during the company's fourth quarter earnings call.

Facebook is not aware of any misuse of the vulnerability, a source at the company said. Also, triggering it would have required knowledge of the ID of the person's photo album based on its URL, as well as permission to view the album based on the album's privacy settings.

The issue could not enable someone to log into another's account, nor did it allow access to view any other part of a person's account.

$12,500 is above average for a Facebook bug bounty reward, with $500 being the minimum reward. Last year a computer engineer was awarded $33,500 for discovering a vulnerability that could have let a hacker read almost any file on a Facebook server.

Zach Miners covers social networking, search and general technology news for IDG News Service. Follow Zach on Twitter at @zachminers. Zach's e-mail address is zach_miners@idg.com


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Tags securitysocial mediainternetFacebooksocial networkingInternet-based applications and services

Featured

Slideshows

Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Show Comments