A security researcher has discovered a critical vulnerability that could allow someone to gain access to Facebookthrough websites that use the 'Log in with Facebook account' feature.
This problem, although it does not expose the user's actual Facebook password, allows the hacker to gain access to other people's accounts using Facebook's login feature, which is found on websites such as Bit.ly, Mashable, Vimeo, About.me, Stumbleupon, Angel.co, and potentially many others.
Researcher Egor Homakov, from the company Sakurity, notified the popular social network of his discovery a year ago, but the company refused to fix the vulnerability because it would have destroyed Facebook's compatibility with many other websites that connected to this feature.
The problem refers to the lack of protection for CSRF (Cross-Site Request Forgery) in three different processes which are:
Facebook login
Facebook log out
Third-party account connection
In the first two cases, the problem can be fixed by Facebook, Homakov says. However, the third must be fixed by the administrators of each website that has integrated the “Login with Facebook account” function.
Blaming Facebook for the problem in the 'Login with Facebook account' feature, the researcher released a tool called RECONNECT, which exploits the flaw and lets hackers create URLs that they use to hijack accounts of users who use the above feature to log in to other websites through their Facebook account.
In order to protect their account, the user should avoid selecting suspicious URLs found in emails or social media accounts.
For its part, Facebook says that it has been aware of the issue for some time now and that websites can protect their users by using Facebook's best practices when they have integrated the login function into their website.
