Facebook Bug Bounty Submissions Dramatically Increase

Facebook today reported a dramatic increase in 2013 submissions to its bug bounty program, and said that despite reports from researchers that it’s becoming difficult to find severe bugs on its various properties, the social network plans to increase rewards for critical bugs. “The volume of...

FBCacheView - Shows Facebook images stored in the cache of your Web browser

FBCacheView is a simple tool that scans the cache of your Web browser Internet Explorer, Firefox, or Chrome, and lists all images displayed in Facebook pages that you previously visited, including profile pictures, images uploaded to Facebook, and images taken from other Web sites. For every...

PhotoWIFI Lite 1.0 iOS - Multiple Vulnerabilities

Document Title: =============== PhotoWIFI Lite v1.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1239 Release Date: ============= 2014-03-27 Vulnerability Laboratory ID VL-ID: ==================================== 123...

Security the Facebook Way

Protecting the internal network as well as the users of Facebook is an unenviable task. Facebook users constantly are the target of all manner of phishing, malware and other attacks, and the company’s own network is a major prize for attackers, as well. To help better defend those assets,...

Facebook Unveils ThreatData, a framework for Web Security

Defending and Analysis of online threats and malwares have become more challenging nowadays and especially for larger businesses like the popular social networking site - Facebook. To encounter malware, phishing, and other online threats, Facebook has taken an important step forward. Facebook has...

Hootsuite Recovers from Denial of Service Attack

Social media management system Hootsuite recovered rapidly from a denial of service DoS attack late last week, bouncing back after being offline for a few hours Thursday morning. During that time, starting around 9:45 a.m. EST., users of the site were unable to use the service after a malicious...

HACK - A New Open Source Programming Language developed by Facebook

Facebook just released a new programming language called 'HACK', designed to build complex websites and other software quickly and without many flaws. The company has already migrated almost all of its PHP-based social networking site to HACK over the last year, but it has nothing to do with...

Qe 4.1.6 Cross Site Scripting

Exploit Title: Qe 4.1.6 Cross site scripting Date: 2014 18 March Author: Dr.3v1l Vendor Homepage: http://c97.net Version : 4.1.6 Tested on: Windows Category: webapps Google Dork: Open your eyeZ + Exploit : http:///qe4.1.6/install/install.php URL encoded GET input cmd was set to : "alert/xss/ The...

Chat2 Cross Site Scripting / SQL Injection

Exploit Title: Chat2 Blind SQL Injection Chat2 Cross site scripting Date: 2014 18 March Author: Dr.3v1l Tested on: Windows Category: webapps Google Dork: inurl:"/chatrooms.php" + Exploit SQL: http:///Chat2/jumpin.php URL encoded POST input userid was set to :...

Snowden's disclosures haven't changed much about Facebook Security

Mark Zuckerberg is continually denying working with the NSA or any other Government Intelligence Agency in serving out data they gathered through extended surveillance, and even he expressed his indignation over the damage the Government is creating for all, on the phone call to the US President...

The NSA and Mark Zuckerberg's Righteous Anger

Mark Zuckerberg is mad as hell, and he’s not going to take it anymore. Actually, he is going to take it, because we all are going to take it, at least for the foreseeable future. Zuckerberg is upset that the NSA is spying on his users, and even madder that the agency is allegedly using fake...

HackerOne: Securing sensitive pages from SearchBots

I reported the issue earlier Report 3662 .But instead of asking more information,you just closed the bug.Well,you said you never seen google indexing authentication tokens. okCupid,is a client of hackerone.com.Let's see whats google doing with their tokens: Search with the following dork:...

BEWARE of new Facebook Malware Claims, 'Malaysia Plane MH370 Has Been Spotted'

Hackers are very smart on gaining from every opportunity they get and this time the lost Malaysian Airlines flight MH370 gave them a chance to hijack, not the plane, but you all sitting over their operating your Facebook account and having an eye on every news related to the Mysterious Malaysian...

NSA Denies Impersonating Facebook to Exploit Targets

The NSA on Thursday responded to media reports that it has been impersonating Facebook and other sites in order to compromise surveillance targets’ machines, saying that the agency “does not use its technical capabilities to impersonate U.S. company websites.” It is relatively rare for the NSA to...

Phabricator: OAuth Stealing Attack (New)

Hi Evan, I found a new and more dangerous way to steal phabricator facebooks oauth tokens,codes, In this case, I exploited the behavior of Phabricator OAuth Dialog, If you provide a differnet scope in phabricator OAuth Dialog...

Project TURBINE: NSA spreads sophisticated Malware Worldwide

Besides collecting metadata and inserting backdoor to the devices and softwares, the US National Security Agency NSA has an eye on each post, picture, message you have ever sent on Facebook. I know you won’t be feeling free considering your privacy, but, this is what the NSA is doing to you. The...

Hacking Facebook User 'Access Token' with Man-in-the-Middle Attack

Facebook has several security measures to protect users' account, such as a user "access token" is granted to the Facebook application like Candy Crush Saga, Lexulous Word Game, when the user authorizes it, it provides temporary and secure access to Facebook APIs. To make this possible, users hav...

Phabricator: OAuth access_token stealing in Phabricator

Hi, I found that an attacker is able to steal accesstokens of facebook users via Phabricator App 184510521580034. when users login to phabricator, they can choose to login via Facebook https://secure.phabricator.com/login/ attaching pic, In this case an attacker is able to exploit this behavior t...

Facebook 'Watch naked video of friends' malware scam infects 2 million people

We have seen a lot of Facebook malware and virus infections spreading through friends list, and this time a new clickjacking scam campaign is going viral on Facebook. Hackers spam Facebook timeline with a friend's picture and "See Friend's naked video," or "Friend Name's Private Video." The Pictu...

Privacy Groups Seek to Halt Facebook Acquisition of WhatsApp

The appeal of WhatsApp, the cross-platform mobile messaging app recently acquired by Facebook for a stunning $19 billion price tag, was that it kept to its promise of not collecting user information that would be converted to ad revenue. The acquisition by Facebook, however, likely changes that...