Exposing Private Facebook Photos with a Malicious App

[Laxman] is back again with another hack related to Facebook photos. This hack revolves around the Facebook mobile application’s “sync photos” function. This feature automatically uploads every photo taken on your mobile device to your Facebook account. These photos are automatically marked as private so that only the user can see them. The user would have to manually update the privacy settings on each photo later in order to make them available to friends or the public.

[Laxman] wanted to put these privacy restrictions to the test, so he started poking around the Facebook mobile application. He found that the Facebook app would make an HTTP GET request to a specific URL in order to retrieve the synced photos. This request was performed using a top-level access token. The Facebook server checked this token before sending down the private images. It sounds secure, but [Laxman] found a fatal flaw.

The Facebook server only checked the owner of the token. It did not bother to check which Facebook application was making the request. As long as the app had the “user_photos” permission, it was able to pull down the private photos. This permission is required by many applications as it allows the apps to access the user’s public photos. This vulnerability could have allowed an attacker access to the victim’s private photos by building a malicious application and then tricking victims into installing the app.

At least, that could have been the case if Facebook wasn’t so good about fixing their vulnerabilities. [Laxman] disclosed his finding to Facebook. They had patched the vulnerability less than an hour after acknowledging the disclosure. They also found this vulnerability severe enough to warrant a $10,000 bounty payout to [Laxman]. This is in addition to the $12,500 [Laxman] received last month for a different Facebook photo-related vulnerability.

BlackBerry Storm 2 teardown


Photos of the BlackBerry Storm 2, both inside and out, have been leaked. Engadget provides us with the specifics, going into detail about the four large piezoelectric pressure sensors that sit underneath the screen. It looks as though the screen will still function as a button, just without the physical movement of the previous model that received mixed reviews. For a better explanation of the technology behind the phone’s innovative screen, here’s a video describing it in more detail and a writeup over at the CrackBerry forums.

Hack cameras with the Image Fulgurator

[Wallace] sent in this awesome project built by [Julius Von Bismarck]. The “Image Fulgurator” is the result of mating an optical slave flash with a camera body turned projector. The result is the ability to project ghost images onto a picture being taken by anyone using a camera with their flash. Check out the demo video after the break or hit the project site for more.

Continue reading “Hack cameras with the Image Fulgurator”