[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Fake messages and chat bug in Facebook
- To: full-disclosure <full-disclosure@xxxxxxxxxxxxxxxxx>, bugtraq <bugtraq@xxxxxxxxxxxxxxxxx>, secalert@xxxxxxxxxxxxxxxxxx, bugs@xxxxxxxxxxxxxxxxxxx, vuln <vuln@xxxxxxxxxxx>, vuln@xxxxxxxxxxxxxxxx, news@xxxxxxxxxxxxxx, moderators@xxxxxxxxx, submissions@xxxxxxxxxxxxxxxxxxxxxxx, submit@xxxxxxxxxxxxxx, oss-security@xxxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Fake messages and chat bug in Facebook
- From: Matteo Fabbri <matteo@xxxxxxxxxxxx>
- Date: Fri, 29 Jun 2012 21:08:41 +0200
Knowing the user registration email is possible to send fake messages /
chat to facebook users.
The only thing required is a fake mail with as the sender the victim
registration email addressed to the facebook ids followed by "@facebook.com
"
Example:
from victim.email@xxxxxxxxxxx to friend1@xxxxxxxxxxxx, friend2@xxxxxxxxxxxxx
..
Sent email will be shown in Facebook like a private message (or chat if
multiple recipients are specified) sent by the Facebook account of the
victim.
(Previously reported vulnerabilities to Facebook)
Matteo Fabbri
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/