Facebook Messenger exposing deleted messages using [Remove for Everyone]

Renwa
Renwa
Aug 15, 2019 · 3 min read

I don’t usually do write-ups for my findings but this one is so funny that every time i get a giggle when i think about how i found it, this also shows you don’t need to be a web expert to find bugs.

It’s July i was talking with a friend on FB messenger the topic was about boys, in one of my messages i made a typo instead of writing (kwr) i wrote (ker) both (w) and (e) keys are beside each other, this may look normal but..

I was talking in Kurdish and the translations are:

kwr = Boy

ker = Penis

It was embarrassing and i deleted the message immediately using [Remove for Everyone] feature, this will delete the message permanently in both sides and replace it with a text (You removed a message)

Image for post
Image for post
Removing message box dialog

For a second i thought wait this may happened before and i didn’t notice it, Saying word (kwr) (boy) is not a rare thing and maybe i made this typo before. Messenger has a feature for searching for any message in all of your conversations so i used that to search for (ker), surprisingly this came out in the results:

Image for post
Image for post
Conversations search results

When i clicked to see the message it didn’t go to the conversations history and show the exact message, it only showed the result, Does that mean i made that typo before?

After some investigation i figured out that that (1 result) prompt is my deleted message and i didn’t make any typos before.

But how is that possible? isn’t FB deleting that message permanently?

Using this bug i was able to see that FB is keeping a deleted message for about 9 days so next time think twice when you send nudes in Messenger, FB doesn’t state about this in anywhere but in the deleting dialog box it says you can still report a deleted message if it’s against community standards.

While reporting this to FB i made some nice POC’s using bruteforcing to recover a deleted message if it was a Porn website or a 4 digit number.

Here is the exact photo of my deleted message that lead to this discovery:

Image for post
Image for post
Typos can make you earn $

Isn’t that a funny find 😂

Image for post
Image for post

Facebook patched it within a month are rewarded me with 0x1f4

buh-bye ~💜

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch

Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore

Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store