Facebook also has a "feature" that will search your AIM or MSN IM buddy lists for other Facebook users. The search result will present you a list of user's default profile photos, and their full real name.
After you run this search Facebook will automatically save your IM screen name/account on your Facebook profile. On Wed, Aug 11, 2010 at 8:13 PM, werew01f <hack.werew...@gmail.com> wrote: > Don't seems to work on my system. No user name or picture was displayed. > > > On Wed, Aug 11, 2010 at 5:01 PM, Atul Agarwal <a...@secfence.com> wrote: >> >> Hello all, >> >> Sometime back, I noticed a strange problem with Facebook, I had >> accidentally entered wrong password in Facebook, and it showed my first and >> last name with profile picture, along with the password incorrect message. I >> thought that the fact that it was showing the name had something to do with >> cookies stored, so I tried other email id's, and it was the same. I wondered >> over the possibilities, and wrote a POC tool to test it. >> >> This script extracts the First and Last Name (provided by the users when >> they sign up for Facebook). Facebook is kind enough to return the name even >> if the supplied email/password combination is wrong. Further more,it also >> gives out the profile picture (this script does not harvest it, but its easy >> to add that too). Facebook users have no control over this, as this works >> even when you have set all privacy settings properly. Harvesting this data >> is very easy, as it can be easily bypassed by using a bunch of proxies. >> >> As Facebook is so popular, some implications - >> >> 1) Someone has a list of email address that he has no clue about. He can >> feed them to Facebook one by one (or in a list, using a script like this) >> and chances are that he'll get more than 50% hits. Useful for phishing >> attacks (People will get more convinced when they see their *real* names). >> >> 2) One can generate random email addresses, and *verify* their existence . >> Hint: You can generate emails using (common names + a corporate domain), and >> check them against Facebook. Might come handy in a Pentest. >> >> Rest is only left up to one's imagination. >> >> Find the POC script attached. >> >> PS: I did not report this, as I am unsure on what to call it, a "bug", >> "vuln" or a "feature". >> >> Thanks, >> Atul Agarwal >> Secfence Technologies >> www.secfence.com >> >> _______________________________________________ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/