Social Media. Friend or Foe?
Here is the scene:
You’re surfing Facebook. Scrolling down your timeline, and you come across what looks like a fun little quiz. “What Disney character are you?” You answer a few inherently ridiculous questions and there it is. “You are Jasmine, from Aladdin!” then you share to all of your friends on Facebook with a link for them to take the quiz too!
Innocent enough right?
So what’s REALLY happening?
You click on the link. It takes you to a site that looks very much like a fun little quiz taking site. You enter personal information into their site. Your Facebook login (as you are prompted to “sign in” before you start your quiz) and password, which alarming studies show people use the same passwords for everything. So you have now given hackers any personal info that is on your page. Where you live, where you grew up, phone numbers, emails, messages, payment info if you use Facebook payment services, you name it. And if in fact you are one of those people that has the same login and password for everything you do online....
Think about what they now can access. Your bank account... (Thanks to the payment information stored in your Facebook account, they know where you bank at, so they simply try your email/password combination, and BAM. They are IN. And you are broke.
Emails!!! How much information do you think a hacker can gain if they have access to your email??? Password reset links, identity verification links, personal identifiable information in saved folders, copies of tax returns. (With your social security number on it) What do YOU save in your email? :-)
Investment accounts, Mortgages, Health Information. All is at risk to being exposed. ALLLLLLL because you wanted to know what DISNEY character you are. Or what animal you would come back to life as? Or who your “squad” is...
Your online safety is JUST (if not MORE) as important as your physical safety. Do you lock your doors at night? Do you look both ways when crossing the street? Do you wear your seat belt? Well, what makes your online safety any less important? If a hacker gets a hold of your Personal Information, it isn’t fixed with a simple password change. Once someone has your social security number, they can assume your entire identity and put you in financial and legal ruin. Sometimes the clean up of ID theft can take YEARS.
An article in “The Hacker News” talks about this very issue and how it is becoming increasingly important to spread awareness about. A researcher by the name of Samm0uda recieved a $25,000 bug bounty for discovering this vulnerability.
“All the attacker needs to do is trick the victims into clicking a specially crafted Facebook URL, as mentioned on his blog, designed to perform various actions like posting anything on their timeline, change or delete their profile picture, and even trick users into deleting their entire Facebook accounts.”
"This is possible because of a vulnerable endpoint which takes another given Facebook endpoint selected by the attacker along with the parameters and makes a POST request to that endpoint after adding the fb_dtsg parameter," Samm0uda says on his blog.
BUG BOUNTY WRITE UPS, by Samm0uda:
https://ysamm.com/?p=185
How to Hack Facebook Accounts? Just Ask Your Targets to Open a Link, The Hacker News:
https://thehackernews.com/2019/02/hack-facebook-account-password.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28The+Hackers+News+-+Cyber+Security+Blog%29&_m=3n.009a.1929.iu0ao0drgi.16uk
