You don’t want personal info on Facebook easily tapped by thieves searching for personal information about you, right? Well if you said yes, you should be concerned. Thankfully, a a UK-based developer of apps for iOS and Android devices, Gareth Wright, discovered the hole and reported it to Facebook. The social networking giant told him that they were working on a fix. The problem is that Facebook’s app for iOS and Android devices doesn’t encrypt your login credentials, making them a sitting duck for bad apps or a tapped USB connection.
In Wright’s blog he wrote that he discovered the flaw while poking around some of the application directories in his phone (applies to Android as well). In the course of his prodding, he discovered a Facebook access token in one of the games on his phone. After copying the token’s code, he was able to take advantage of it to extract information from Facebook using the Facebook Query Language. “Sure enough, I could pull back pretty much any information from my Facebook account,” he wrote. And if he could do that, anyone who snatched one of those tokens could do it, too. “My jaw dropped as over the next few minutes I watched posts appear on my wall, private messages sent, webpages liked and applications added,” Wright wrote. Hopefully Facebook can fix this security flaw,. but, Wright noted, even if Facebook plugs the hole in its app, its members still remain vulnerable to an attack by using the plain text token that many developers are storing in their games’ plists.
Earlier this year, the Facebook Android app was claimed as one of several that infiltrated SMS messages created on the phones it was installed on. Facebook denied that accusation. Although its app requests permissions to receive, process and write text messages as well as read those communications, the app doesn’t use those permissions, Facebook said. My question would be, “Why would the app request permissions, then?”.
[via Gareth Wright Blog]
