Researcher: Face.com iOS flaw could have allowed Facebook, Twitter account hijacking

Face.com patched a vulnerability that could have allowed attackers to hijack the Facebook and Twitter accounts of its customers

Facial recognition start-up Face.com patched a vulnerability in its KLINK iOS app that could have allowed attackers to hijack the Facebook and Twitter accounts of its users, according to Ashkan Soltani, the independent security researcher who claims to have found the flaw.

KLIK is a camera app designed to allow users to easily tag friends in new photos by scanning their Facebook photo albums. It uses facial recognition technology developed by Face.com.

In order to use the app, users need to grant it access to their Facebook accounts. However, the app can also be integrated with Twitter, where it can post messages on their behalf.

A simple vulnerability in the app allowed users to access each others' Facebook and Twitter accounts, Soltani said in a blog post on Monday, the same day Face.com announced that it had been acquired by Facebook.

The vulnerability was caused by Face.com storing Facebook and Twitter OAuth tokens -- unique authentication keys -- on its servers in an insecure way that made them accessible to anyone, Soltani said.

With access to users' OAuth tokens, an attacker could abuse the KLIK app's permissions on their accounts. This includes the ability to access their private photos and friend lists or to post status updates and tweets in their names.

Since the vulnerability affected facial recognition technology, the privacy implications were significant, Soltani said. An attacker could hijack a popular user's account -- like Lady Gaga's, had she used KLINK -- and build face prints for their millions of Facebook friends. Then they could match those in real time to people walking down the street.

"Since this was a vulnerability that could potentially reveal sensitive consumer information, I worked with Face.com, Facebook, and Twitter to make sure it was addressed before disclosing it," Soltani said.

Face.com did not immediately return a request for comment.

Join the PC World newsletter!

Error: Please check your email address.

Struggling for Christmas presents this year? Check out our Christmas Gift Guide for some top tech suggestions and more.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?