Home / / Recover Your Account Recover Your Account 28/09/2021 When you sign-up for a social network you expect it to lớn keep its privacy promises. For instance, if you tell the social network not to lớn reveal your email address khổng lồ any other members, you expect it khổng lồ remain private.Bạn đang xem: Recover Your AccountBut a security researcher has detailed how he found a way lớn find out *any* Facebook user’s primary email address, regardless of their privacy settings, by exploiting a weakness on the social network.Security researcher Stephen Sclafani described how he stumbled across the privacy hole while ambling through some old mailing lists.Xem thêm: One of the messages he came across contained a Facebook invitation reminder gmail, seemingly sent by accident when the user made the mistake of following Facebook’s advice to invite their entire contacts các mục to lớn the social network:What is interesting is the clickable URL at the bottom of the invite message.When Sclafani clicked on the liên kết, he was taken to a Facebook sign up page already filled in with the mailing list’s address & the name of the person who used the links to lớn sign up for an account:Sclafani took a closer look at the link, & discovered something interesting:http://www.facebook.com/r.php?re=245bf2da75118af20d917bdd34babddb&mid=59b63aG5af3107aba69G0G46Changing the re parameter did nothing; however, changing parts of the mid parameter resulted in other addresses being displayed. Taking a closer at the parameter, its value was actually a string of values with “G” acting as a delimiter:59b63a G 5af3107aba69 G 0 G 46Only the second value was important. The value was an ID associated with the address that the invitation was sent khổng lồ in hex. A Facebook user’s numerical ID could be put as this value & their primary tin nhắn address would be displayed. A user’s numerical ID is considered public information and can be obtained from the source of their profile or through the Graph API.In other words, if you replaced that part of the “mid” parameter with the hex value of a different Facebook users’ numerical protệp tin ID, you would be shown their primary gmail address.Facebook protệp tin IDs aren’t secret. You can get them easily via sites like Find My Facebook ID or from Facebook’s own protệp tin directory.Indeed, it’s possible to imagine how someone interested in grabbing the email address of *every* *single* Facebook user could write a script lớn trawl the protệp tin directory, turn each ID inkhổng lồ hex, và then use the modified URL lớn ultimately scoop up each address.It’s easy lớn imagine how a database of such gmail addresses could be abused.Fortunately, Stephen Sclafani has some ethics. And rather than try to lớn make a big splash by publishing details of Facebook’s embarrassing flaw, he chose khổng lồ discthất bại it responsibly to lớn the social network. Sclafani says that Facebook fixed the flaw within 24 hours, và rewarded him $3,500 for his efforts under their Bug Bounty program.Facebook certainly appear khổng lồ be grateful that he acted in the way he did, telling me:"We appreciate the security researcher"s effort khổng lồ report this issue lớn our White Hat Program. We worked with the researcher to lớn evaluate the scope of the issue and fix this bug quickly. We have sầu no evidence that it was exploited maliciously.""We have provided a bounty lớn the researcher lớn thank hyên ổn for his contribution khổng lồ Facebook security."Well done khổng lồ Sclafani for finding the flaw and acting responsibly. And – although it would have been better if the privacy loophole hadn’t been there in the first place – well done lớn Facebook for fixing it so quickly after being informed.