FACEBOOK BUG THAT EARNED 12500 DOLLARS

© Provided by The Verge

This week, a researcher named Laxman Muthiyah discovered up a bug that let him delete any photo album on Facebook, and walked away with $12,500 for his trouble. The bug targeted Facebook's Graph API, which lets users delete their own photo albums with a single command, corresponding to the "delete album" button. Because of a mistake on Facebook's part, that request could potentially target any album on the network, as long as the user was logged in through the mobile version of the API. After some troubleshooting, Muthiyah settled on the following request as the silver bullet for deleting any album off the network:

Request :-
DELETE /518171421550249 HTTP/1.1
Host : graph.facebook.com 
Content-Length: 245
access_token= facebook_for_android_access_token

Muthiyah reported the vulnerability to Facebook and the company wrote back in just two hours, saying the bug was fixed and offering him $12,500 through Facebook's bug bounty program. Presumably, the fix was simple — altering the mobile app permissions was likely enough — but it's a reminder of how much damage even a small bug can do. Sophos has already speculated that the bug could have been used to delete every photo on Facebook, provided the attackers used a botnet to get around any rate-limiting provisions. Luckily, Muthiyah did the right thing and reported the bug, walking away with a sizable reward.