Hacker finds bug that allowed anyone to bypass Facebook and Instagram 2FA

Advertisements
A screenshot of an email sent by Meta to a user that says: "We wanted to let you know that your phone number registered and verified by another person on Facebook."

A bug in a new centralized system that Meta created for users to manage their logins for Facebook and Instagram could have allowed hackers to switch off an account’s two-factor protections just by knowing their email address or phone number.

Gtm Mänôz, a security researcher from Nepal, realized that Meta did not set up a limit of attempts when a user entered the two-factor code used to log into their accounts on the new Meta Accounts Center, which helps users link all their Meta accounts, such as Facebook and Instagram.

With a victim’s phone number or email address, the hacker would go to the centralized accounts center, enter the phone number of the victim, link that number to their own Instagram or Facebook account, and then brute force the two-factor SMS code. This was the key step, because there was no upper limit to the amount of attempts the hacker could make.

Once the hacker got the code right, the victim’s phone number became linked to the hacker’s account. A successful attack would still result in Meta sending a message to the victim, saying their two-factor was disabled as their phone number got linked to someone else’s account.

“Basically the highest impact here was revoking anyone’s SMS-based 2FA just knowing the phone number,” Mänôz told TechCrunch.

An email from Meta to an account owner telling them that their two-factor protections have been switched off. Image Credits: Gtm Mänôz (screenshot)

At this point, theoretically, the hacker could try to take over the victim’s account just by phishing for the password, given that the target didn’t have two-factor enabled anymore.

Mänôz found the bug in the Meta Accounts Center last year, and reported it to the company in mid-September. Meta fixed the bug a month later, and paid Mänôz $27,200 for reporting the bug.

It’s unclear if any malicious hackers also found the bug and exploited it before Facebook fixed it. Meta did not immediately respond to a request for comment.

Hacker finds bug that allowed anyone to bypass Facebook and Instagram 2FA by Lorenzo Franceschi-Bicchierai originally published on TechCrunch

      



Author: AliensFaith
HighTech FinTech researcher, university lecturer & Scholar. He is studying his second doctoral degree at the Hague International University. Studying different fields of Sciences gave him a broad understanding of various aspects of life. His recent researches covered AI, Machine-learning & Automation concepts. The Information Technology Skills & Knowledge gave his company a higher position over other regional high-tech consultancy services. The other qualities and activities which can describe him are a Hobbyist Programmer, Achiever, Strategic Thinker, Futuristic person, and Frequent Traveler.

Discover more from Maheri Network

Subscribe now to keep reading and get access to the full archive.

Continue reading

Exit mobile version