Researcher: iOS flaw could have allowed Facebook, Twitter account hijacking

Facial recognition start-up patched a vulnerability in its Klik iOS app that could have allowed attackers to hijack the Facebook and Twitter accounts of its users, according to Ashkan Soltani, the independent security researcher who claims to have found the flaw.

Klik is a camera app designed to allow users to easily tag friends in new photos by scanning their Facebook photo albums. It uses facial recognition technology developed by

In order to use the app, users need to grant it access to their Facebook accounts. However, the app can also be integrated with Twitter, where it can post messages on their behalf.

A simple vulnerability in the app allowed users to access each others' Facebook and Twitter accounts, Soltani said in a blog post on Monday, the same day announced that it had been acquired by Facebook.

The vulnerability was caused by storing Facebook and Twitter OAuth tokens—unique authentication keys—on its servers in an insecure way that made them accessible to anyone, Soltani said.

With access to users' OAuth tokens, an attacker could abuse the Klik app's permissions on their accounts. This includes the ability to access their private photos and friend lists or to post status updates and tweets in their names.

Since the vulnerability affected facial recognition technology, the privacy implications were significant, Soltani said. An attacker could hijack a popular user's account—like Lady Gaga's, had she used Klik—and build face prints for their millions of Facebook friends. Then they could match those in real time to people walking down the street.

"Since this was a vulnerability that could potentially reveal sensitive consumer information, I worked with, Facebook, and Twitter to make sure it was addressed before disclosing it," Soltani said.

"We can confirm that on Friday, June 15th, a security vulnerability was pointed out to us," a spokesman said via email. "The problem was resolved within an hour after being reported and the issue is now fixed. No users were affected, nor was any private information disclosed."

Product mentioned in this article

(1 items)

  • KLIK by Free
    Shop ▾
    Amazon Shop buttons are programmatically attached to all reviews, regardless of products' final review scores. Our parent company, IDG, receives advertisement revenue for shopping activity generated by the links. Because the buttons are attached programmatically, they should not be interpreted as editorial endorsements.

    Get It for Free

Subscribe to the Best of Macworld Newsletter