Tool allows account hijacking on sites that use Facebook Login

Attackers can force users to associate their accounts on other sites with malicious Facebook accounts

A new tool allows hackers to generate URLs that can hijack accounts on sites that use Facebook Login, potentially enabling powerful phishing attacks.

The tool, dubbed Reconnect, was released last week by Egor Homakov, a researcher with security firm Sakurity. It takes advantage of a cross-site request forgery (CSRF) issue in Facebook Login, the service that allows users to log in on third-party sites using their Facebook accounts.

Homakov disclosed the issue publicly on his personal blog in January 2014, after Facebook declined to fix it because doing so would have broken compatibility with a large number of sites that used the service.

"Facebook refused to fix this issue one year ago, unfortunately it's time to take it to the next level and give blackhats this simple tool," Homakov said in a blog post Thursday.

The attack involves generating malicious URLs. When potential victims are tricked into clicking on the urls, they are logged out of their own Facebook accounts and into rogue accounts on the social network that have been set up by the attackers. Also in the background, their accounts on websites that use Facebook Login are linked to the rogue Facebook accounts set up by the attackers.

This gives attackers control over the victims' accounts on those third-party sites, allowing them to change passwords, read private messages and perform other rogue actions using the hijacked accounts, Homakov said.

The Reconnect proof-of-concept tool can also generate malicious URLs to hijack accounts on Booking.com, Bit.ly, About.me, Stumbleupon, Angel.co, Mashable and Vimeo. However, many more sites that support Facebook Login can be targeted by manually inputting into the tool the links that trigger Facebook login requests on behalf of their users.

In all, the attack exploits the lack of CSRF protection for three separate processes -- Facebook login, Facebook logout and third-party account connection -- Homakov said. He said the first two issues can be fixed by Facebook, but the third one needs to be fixed by the sites that integrate Facebook Login.

Facebook did try to make the issue harder to exploit, to the extent it was possible without breaking functionality, and has provided guidance to website developers.

"This is a well-understood behavior," the company said in an emailed statement. "Site developers using Login can prevent this issue by following our best practices and using the 'state' parameter we provide for OAuth Login."

"We've also implemented several changes to help prevent login CSRF and are evaluating others while aiming to preserve necessary functionality for a large number of sites that rely upon Facebook Login," the company said.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Sakurityonline safetysecurityAccess control and authenticationExploits / vulnerabilitiesIdentity fraud / theftFacebook

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?