Facebook ID theft threat impacts all iPhones, Dropbox

[Starbuck]

Although Facebook says that a vulnerability allowing someone to access another user's account only affects jailbroken iPhones, two reports say that's not the case.

 

U.K. app developer Gareth Wright and The Next Web have separately confirmed that the issue, which originates from Facebook's iPhone application, actually affects any iPhone, and not just those that have been jailbroken.

 

Wright announced his findings earlier this week. He claims that Facebook's iPhone application includes a vulnerability that fails to encrypt log-on credentials when a user accesses the social network from its mobile application. Wright said that he then came across a Facebook access token in the Draw Something game, which he copied, and after using the Facebook Query Language, extracted the information contained within.

 

"Sure enough, I could pull back pretty much any information from my Facebook account," he wrote. He went on to say that the app's property list contained all the information needed to allow someone else to access a person's Facebook account, send private messages, and do whatever else they wanted on the site.

 

In a statement to CNET yesterday, Facebook said the issue only affects jailbroken devices.

 

"Facebook's iOS and Android applications are only intended for use with the manufacture provided operating system, and access tokens are only vulnerable if they have modified their mobile OS (i.e. jailbroken iOS or modded Android) or have granted a malicious actor access to the physical device," the social network said in a statement.

 

In addition to Wright, The Next Web, which re-created the hack, confirmed that it "does not require a jailbreak."

 

But the blog also went one step further and found that Dropbox also suffers from the same flaw, leaving the application open to a so-called "plist," or property list, hack.

 

"We copied the .plist from one device with the app installed and logged in, over to another which had a fresh installation of Dropbox on it," The Next Web said. "The profile copied and it worked seamlessly, as if we had logged on ourselves, which we had not."

 

One other interesting tidbit from the findings on Dropbox: the hack will even work on an iPhone protected by a passcode.

 

 

Source:

http://news.cnet.com/8301-13579_3-57410475-37/facebook-id-theft-threat-impacts-all-iphones-dropbox/?part=rss&tag=feed&subj=News-DigitalMedia