Serious vulnerability helps hackers attack Facebook accounts without the victim's actions

The problem was discovered and patched on February 2, but was only announced now due to security regulations.

The vulnerability is related to the Facebook password reset process through the optional feature of sending authentication codes. This 6-digit code is sent to another device logged in or pre-registered by the user to authenticate the original user and is used to complete the password reset process on a new device.

According to Samip Aryal's findings, Facebook sends a fixed authentication code (does not change the number sequence), is valid within 2 hours and has no security measures.

This means that crooks can enter the wrong activation code countless times within 2 hours of sending the code without encountering any preventive measures from Facebook's system. Normally, the security system will suspend login rights if the wrong code or password is entered more than the specified number of times.

Hackers can use 2 hours to steal user accounts.

This is a 0-click attack, hackers can steal the victim's account without any action from them.

When this vulnerability is exploited, Facebook will send a password recovery notification to the victim. Therefore, if you receive this message, it is likely that your account is being attacked or hijacked.

Isabella Humphrey

Update 04 March 2024

You should read it

May be interested

How are scammers using your face to commit fraud?
how cautious are you about how your face is used on the internet? if you do not appreciate the importance of this, you should change it immediately.
The new attack technique uses a wireless charger to issue voice commands and heat up the device
researchers at the university of florida and certik discovered a new series of attacks called 'voltschemer' that can use the magnetic field emitted from a wireless charger to issue voice commands that control the phone's voice assistant. smart phone.
New malware discovered that can bypass Windows SmartScreen and steal user data
international security researchers from the trend micro team have just issued an urgent warning about a previously unknown type of malware that is actively exploiting the windows defender smartscreen vulnerability cve-2023-36025. and compromise the target computer.
What is Quishing? How to prevent a Quishing attack?
what is a quishing attack? how does this form of attack work and what can you do to protect yourself from being targeted?
How to Secure GraphQL API: Implement User Authentication in Express.js Using JWT
jwt provides a simple solution to complex validation error handling. below are instructions on how to secure graphql apis.
How to Stay Away from Pornography
watching pornography is an unhealthy habit that can strain your life and relationships. if you're having trouble giving up pornography, try eliminating all access to it and finding more positive ways to restrain yourself from temptation.

Serious vulnerability helps hackers attack Facebook accounts without the victim's actions

You should read it

May be interested

Attack the network