Zahid Ali
Zahid Ali
Feb 4, 2017 · 2 min read

Facebook Groups Hack

In 2015, I reported to Facebook that it is possible to deactivate another user’s account through “Account Recovery Form”. This can be accomplished if the account has registered a phone number. Facebook allows users to submit form if they need help to recover account. However, that form was only available for the users who registered their Facebook ID with phone numbers.

I reported that due to account deactivation, a user can lose certain activity on an account.

I got reply from Facebook security member Annalise, that said,

“Locking accounts is intended in some scenarios to
protect users from attack. Thank you for sharing this information with
us. Although this issue does not qualify as a part of our bounty
program we appreciate your report. We will follow up with you on any
security bugs or with any further questions we may have.”

Same year, another researcher reported that, if a group has one admin and the admin account is deactivated, any member can become an admin of this group. Facebook rejected that bug and said,

“On the deactivation page, we warn users that due to account deactivation they will lose the groups”

So, in 2016 I merged these 2 rejected report(s) and sent it to Facebook that due to account deactivation by attacker, victim will lose all the groups.

Here is the POC video.

Image for post
Image for post

They accepted and I got a bounty from Facebook. :)

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store