Update: Face.com iOS flaw could have allowed Facebook, Twitter account hijacking

Vulnerability in Klik app could have allowed attackers to take over customers' Facebook and Twitter accounts, security researcher says

Facial recognition startup Face.com patched a vulnerability in its Klik iOS app that could have allowed attackers to hijack the Facebook and Twitter accounts of its users, according to Ashkan Soltani, the independent security researcher who claims to have found the flaw.

Klik is a camera app designed to allow users to easily tag friends in new photos by scanning their Facebook photo albums. It uses facial recognition technology developed by Face.com.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]

In order to use the app, users need to grant it access to their Facebook accounts. However, the app can also be integrated with Twitter, where it can post messages on their behalf.

A simple vulnerability in the app allowed users to access each others' Facebook and Twitter accounts, Soltani said in a blog post on Monday, the same day Face.com announced that it had been acquired by Facebook.

The vulnerability was caused by Face.com storing Facebook and Twitter OAuth tokens -- unique authentication keys -- on its servers in an insecure way that made them accessible to anyone, Soltani said.

With access to users' OAuth tokens, an attacker could abuse the Klik app's permissions on their accounts. This includes the ability to access their private photos and friend lists or to post status updates and tweets in their names.

Since the vulnerability affected facial recognition technology, the privacy implications were significant, Soltani said. An attacker could hijack a popular user's account -- like Lady Gaga's, had she used Klik -- and build face prints for their millions of Facebook friends. Then they could match those in real time to people walking down the street.

"Since this was a vulnerability that could potentially reveal sensitive consumer information, I worked with Face.com, Facebook, and Twitter to make sure it was addressed before disclosing it," Soltani said.

"We can confirm that on Friday, June 15th, a security vulnerability was pointed out to us," a Face.com spokesman said via email. "The problem was resolved within an hour after being reported and the issue is now fixed. No users were affected, nor was any private information disclosed."

Mobile Security Insider: iOS vs. Android vs. BlackBerry vs. Windows Phone
Join the discussion
Be the first to comment on this article. Our Commenting Policies