Facebook WhatsApp Messenger for Android Vulnerability Local Message Disclosure Vulnerability

Facebook WhatsApp Messenger for Android is a suite of mobile applications from Facebook, Inc. in the United States based on the Android platform that utilize the web to send text messages. The application uses the contact information in the smartphone to find contacts using the program to send...

A week in security (September 4 – September 10)

Last week, we looked into expired domain names being used for malvertising, delved into dubious Facebook apps, and checked out Chinese seminar scams. We also explained the whys and wherefores of false positives, explained what Google is doing with HTTPs, warned you away from a fake DHS email, and...

Shopify: Stored XSS through Facebook Page Connection

The following URL https://kitcrm.com/users/122686/connections displays us options to connect our several social networking accounts to kitcrm. Once i connect my facebook account, the facebook section in above link will list out all my facebook page and will give me an option to select a business...

Facebook slapped with $1.43 million fine for violating users' privacy in Spain

Facebook is once again in trouble regarding its users' privacy. The social media giant has recently been heavily fined once again for a series of privacy violations in Spain. Recently, Google also incurred a record-breaking fine of $2.7 billion €2.42 billion by the European antitrust officials fo...

GitLab: Impersonation attack via Broken Link in Resellers Page

Summary A link on https://about.gitlab.com/resellers/ was broken and could've allowed a user to impersonate a reseller and attack / scam your customers. Proof of Concept 1. Visit https://about.gitlab.com/resellers/ 2. Hit Ctrl+F and find "intenso" F219301 3. Now click the Facebook link and you'll...

Quora: IDNs displayed in unicode

Hello Quora, Please refer https://en.wikipedia.org/wiki/Internationalizeddomainname to know more about IDNs. The IDN Internationalized Domain Name : http://ebаy.com/ is a homograph for the latin ebay.com. if you click that first link, you might think that you are going to ebay.com but in fact, yo...

Facebook worries: I didn’t post that

It is my assumption that most Facebook users don’t look at their own profile often. With your own profile, I mean the timeline that shows up when you click your own name or avatar in the Facebook menu. That’s because we think we know exactly what is posted there, so why bother to look at it? Afte...

web.facebook.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-289783 Description| Value ---|--- Affected Website:| web.facebook.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Dissecting the Chrome Extension Facebook malware

It's been a few days since Kaspersky Lab's blog post about the Multi Platform Facebook malware that was spread through Facebook Messenger. At the same time as Kaspersky Lab were analyzing this threat, a few researchers where doing the same, including Frans Rosén, Security Advisor at Detectify...

A week in security (August 21 – August 27)

In our blog posts, we announced the introduction of, and explained the necessity for, real-time protection for our Mac and Android users. Also explaining what you can expect them to do for you and answering the questions that we expect to be frequently asked. We looked at 4 key steps you can take...

Drupal Facebook Like Button Module DRUPAL-SA-CONTRIB-2017-066 Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Facebook Like Button module DRUPAL-SA-CONTRIB-2017-066 due to the program failing to properly filter user-supplie...

New Campaign Uses Facebook Messenger to Distribute Malware

By Waqas A security researcher David Jacoby has revealed that Facebook Messenger This is a post from HackRead.com Read the original post: New Campaign Uses Facebook Messenger to Distribute Malware...

Code injection

The web/webfile/fbpublish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target albumid and accesstoken...

CVE-2014-7860

The web/webfile/fbpublish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target albumid and accesstoken...

CVE-2014-7860

The CVE-2014-7860 issue affects D-Link DNS-320L (pre-1.04b12) and DNS-327L (pre-1.03b04 Build0119). The web/web_file/fb_publish.php script fails to authenticate requests, enabling remote attackers to obtain arbitrary photos and publish them to a Facebook profile using a target album_id and access...

Adware Spreading Via Social Engineering, Facebook Messenger

Attackers have taken to Facebook Messenger with a combination of social engineering and malicious JavaScript to spread adware, something that’s likely earning them a small chunk of change in the process. David Jacoby, a senior security researcher with Kaspersky Lab’s Global Research & Analysis...

New multi platform malware/adware spreading via Facebook Messenger

One good thing about having a lot of Facebook friends is that you simply act as a honey pot when your friends click on malicious things. A few days ago I got a message on Facebook from a person I very rarely speak to, and I knew that something fishy was going on. After just a few minutes analyzin...

Beware of Windows/MacOS/Linux Virus Spreading Through Facebook Messenger

If you came across any Facebook message with a video link sent by anyone, even your friend — just don’t click on it. Security researchers at Kaspersky Lab have spotted an ongoing cross-platform campaign on Facebook Messenger, where users receive a video link that redirects them to a fake website,...

Information Disclosure

facebook-android-sdk is susceptible to information disclosure. The library fails to validate the whether the package name matches the name of the current app, allowing a malicious application to collect facebook credentials...

Facebook Awards $100K to Researchers for Credential Spearphishing Detection Method

A group of researchers recently identified a real-time way to detect credential spearphishing attacks in enterprise settings. The discovery net the researchers $100,000 last week from Facebook, which awards money as part of its annual Internet Defense Prize partnership with USENIX Association. Th...