Facebook Bug - Posting without permissions on behalf of user by Vivek Bansal

Are you using facebook-login in any ANDROID / IOS / Windows / Blackberry or on any website like Quora, Foursquare, Candy Crush Saga, Criminal Case or in any application or website ?
Beware....any application can post any message or image or video on your friend's timeline or on your timeline without asking without you.

Through a script i have written, any application can post any text, image or video on user's and his friend's timeline without taking any permissions or acknowledging user.

Bug :- The bug I reported to Facebook is related to User's privacy.It is related to breach of authentication bridge by posting on User's & his friends wall without taking any Publish Permissions.

Description :- According to Facebook documentation, an application can not post to User's wall & his friends' wall without taking any Publish Permission.

Vulnerability: Using the script i have written, after logging in from Facebook credentials and having acquired only BASIC_PERMISSIONS, script can post any text or share any link on User's and his friends wall, WITHOUT informing user , through a background process.

[vishallodha]

Wow. Excellent bug found. Facebook has to think about this...

[jatinmalwal]

Facebook security sucks. I usually log In using my facebook in android and web apps. This is really a big bug in facebook. This video is really useful. It also describes how to revoke fb access of all login apps. Great work by the White Hat. 

[erikachakraborty]

Nice work.. Never knew fb has some bugs.. Your speculation have made this bug noticeable.. Hope facebook wont keep a scope of such bugs in its application further

[mehakbhasin]

Wow. Excellent bug found. Facebook u better watch out. 👍

[nvnntn]

What the hell... thats y FB should not be the single Social network site....they are already selling our personal info for AD's.


Great job Bansal... 
Tu hi to 1 kam karne wala h humare batch me...keep the good work continue..

[ruchiagrawal]

in july'13 a guy name khalil found a bug in facebook and he posted some message on Mark Zuckerburg's wall and this time this guy can post on my and my friend's timeline through any application...wtf is facebook security... :/
Seriously facebook should need to be take care of user's privacy.

Good work by you...great finding.... (y)

[yogeshkumarpanihar]

Excellent dear nice work.. Keep it up :)

[vandanagarg]

ohh shit...it means all the android/ios applications where i am using facebook login like Quora, Gaana.com, Candy crush Saga etc can post on my timeline or my friend's timeline without taking prior permissions from me.

Once again its proved that facebook is not safe for user's privacy.
Great bug found by you...good work... 

[MilindAudichya]

Great Job Dude..!!! You have done a great job..really appreciable work.. Go for this kind of works in upcoming future too.. you will get much more opportunities with this kind of works in near future.. Best of Luck & Hope For A Great Future Ahead :)

[satyaprakashgupta]

Great job Vivek,        we are not expecting it can be happen earlier, Most of us are using android/ios applications where i am using facebook login like  Gaana.com, Candy crush Saga very frequently, anyone can be post on my timeline. Sometime it creates major problem.
Without taking our permission if anyone can post ..its a big issue.

Thanks buddy you found a great bug...:)

[ankushtailor]

great job bro.n its very true even i hv suffered & my many friends also we should take some action against it how can they share our personal informatn...

[deepesh]

Well done... It's grt job.. Keep it up :)

[Mariaj]

thank you so much! this was very helpful :)

[mohitchauhan-yqyk]

how are you posting on friend's timeline without user permission ?
i.e. according to dis video....any application where i logged-in can post on my friend's timeline without asking any permissions....big bug in facebook security.
Good work...

[satyaprakashgupta]

Oh Shit...its should not be....Facebook developer should all privacy point keep in their mind..otherwise days are numbered.

[bhanuppindia]

good job...facebook going to hired u soon...:P

[pcbbhn]

From where do you get the motivation to do all this stuff? I means it takes lot of courage and hardwork. Share with us too.
BTW it was really a great finding.
Keep it up :)

[Redstarkoushik]

wt can we do to reactivate our account help me

[GopalSinghR]

can i get the .py file just for learning...

[bdayvideo]

Now that it's patched.Please share your python code with us :).