The attack demo against Facebook SSO

No description available.

• Category

  Science & Technology

[Zhou Li]

The fact is that ESPN's web site gets user's consent but the malicious web site doesn't. The malicious web site exploits a Facebook vulnerability to steal the access token possessed by ESPN and then impersonate ESPN to fetch DOB, email, and post on wall.

[Greg Hamm]

Thank you for bringing this to the ATTENTION of FaceBook...First!! And thanks for the job you have done - a great public service to the people that aren't aware of the PRIVACY SETTINGS!

[vineet369]

First was common sense, since name is already pubic.

Third one, is obvious, since at Request for Permission by FB, it specifically says, "Posts on my wall", which it can and most probably will do.

But how did YOU fetched DOB and email address, since those can only be accessed by ESPN, after we have allowed them to do so? From cookies or something?

[alexariciu]

nice work guys.