PSA to all Facebook Camera users on iOS: If you haven’t updated your app in the past few days, update it now. The older version of the app, pre-1.1.2 and released before December 21, has a security loophole. When used over WiFi networks, malicious hackers can tap the network and hijack Camera users’ accounts, picking up information like email addresses and passwords in the process.
The white-hat hacker who ID’d the problem is Mohamed Ramadan, an Egypt-based security researcher and trainer with Attack-Secure who has also found and reported vulnerabilities for Apple, Google, and Etsy — which apparently also had the same loophole in its iOS app. Ramadan tells us that the issue lied in the Camera app’s Secure Sockets Layer certification, which was too open.
As he puts it, “The problem is the app accepts any SSL certification from any source, even evil SSL certifications and this enables any attacker to perform Man in The Middle Attack against anyone uses Facebook Camera App for IPhone. This means that the application doesn’t warn the user if someone in the same [WiFi network] trying to hijack his Facebook account.”
Testing his theory by using a proxy to listen in on a WiFi network, he was able to type in his username and password into the Camera app, and then see that information appear via the proxy.
Ramadan notes that he’s tested all Facebook apps and the rest appear to protect from this similar vulnerability. We’ve reached out to Facebook for comment but haven’t received a response.
[Update: Facebook has confirmed Ramadan’s bug discovery, which it addresses in the 1.1.2 version, and provided us with the following statement, noting that there is no evidence that the bug ever got exploited in the wild:]
“We applaud the security researcher who brought this bug to our attention for responsibly reporting the bug to our White Hat Program. We worked with the team to make sure we understood the full scope of the bug, which allowed us to fix it and upgrade the Camera application without any evidence that this bug was exploited in the wild. Users are only vulnerable if they are using an unsecured or untrusted public wireless network and an older version of the application. As always, we remind all users to only connect to networks they trust. Users can protect themselves by downloading the latest version of the Camera app. Due to the responsible reporting of this issue to Facebook, no one within the security community has evidence of account compromise using this bug. We have provided a bounty to the researcher to thank them for their contribution to Facebook Security.”
Comment