Facebook paid $15,000 to an independent security researcher who discovered a simple way to reset passwords on other people's accounts by setting a new password that only he knew. This way, he could lock out any account he wanted.
The person who discovered the security flaw and helped Facebook fix it before it was abused is Anand Prakash, a security researcher from India.
As he describes in his blog, the issue is actually a trivial brute-force attack on the password recovery form, and not on Facebook's main website, which is protected from this type of automated attack.
The password recovery form can be used whenever a user forgets their Facebook password. They will need to fill out a form with their email address or phone number associated with their Facebook account.
After entering these two details, the user will receive a six-digit code via SMS, which they will enter in the password reset form to allow them access to a page where they can change their account password.
If someone ever tries to guess this six-digit code from the main Facebook website (facebook.com), they will be locked out after 10 or 12 invalid attempts.
Mr. Prakash discovered that this brute-force protection limit was not active on Facebook's beta platform, which is accessible from beta.facebook.com.
It is the platform that Facebook uses to test new features before making them available to the general public through the main platform.
So using a simple brute-force tool, Mr. Prakash was able to discover the six-digit code needed to access each account.
Using a simple script, the researcher tried all possible combinations until he guessed the correct six-digit code. Everything else was easy.
The researcher discovered the issue on February 22, reported it on Facebook, and the company fixed it the next day.
Below is the PoC video posted by the researcher.
