Why you shouldn’t share links on Facebook

The number game

All objects stored on Facebook, whether it’s a picture, a status, or a link, are given a unique, non-chronological identification number. Mark Zuckerberg is object number four:

A developer can request an object by its number through the Facebook API, an interface for developers to connect with Facebook, which will return the corresponding information only if you have permission to access it. This means that you can’t simply access someone else’s private status update without obtaining their permission. Seems logical, right?

I started playing around with this feature. Most of the time, I got an error message that the object either did not exist or that I did not have permission to view it:

As I was about to give up, a URL popped up. Cool, but this left me none the wiser: you can’t do much with a timestamp and a string that says: “website.”

Then I appended “url” to my initial request, asking Facebook if it would be so nice as to display the link address as well. To my surprise, this worked:

At this point, I wondered if I could also use this to view links users privately shared, so I asked my friend Bas to help me out, create a Google $GOOGL Doc and privately share the link. Here’s what I received:

Then I asked Bas to use Facebook Messenger to send the link to himself and click on it:

Since the link was saved to Facebook’s database when Bas opened the link via Messenger, I asked him to use Facebook debugger tool to get the object identification number and provide it to me:

The tool also showed the number identifier attached to the post:

Back to my account. When I tried to access the object attached to the number above, the URL popped up:

Moments later, I was able to access the confidential Google Document:

I tried to reproduce this a couple of times until I decided to find out whether it was also possible to get other people’s (private) links exploiting this. I wrote a quick script that would take any identification number and increment it gradually to discover other links. It worked:

While the results did not include an ID for the user who shared the link, I was able to identify some because their user ID, the number corresponding to their account, was included in the link.

Why this is a big deal

While you may only share links to funny cat videos with your friends, you should still be worried about this exploit. Sometimes, sensitive information (personal data, secret keys, …) are included in links without you even noticing. Just take a look at the redacted and quite innocent looking links from earlier:

In this small set of extracted URL’s, I’ve already found some interesting info:

• Names: Heather, Jenny, Paula, Yollanda, Bernardo, …
• Location or language.
• Attachments or pictures from the FB CDN: Direct link that sometimes allows access bypassing privacy restrictions.
• Application or game data: Some parameters are friend_level, friend_chips, user_name, group, steal_amount, …
• Secret links or hidden keys: Such as the editable Google Drive links or links to hidden pages, websites, and beta environments.

..and these aren’t mutually exclusive; some URLs include multiple parameter types listed above in one single link, thereby allowing a total stranger to gain personal information about you. Hello NSA?

Facebook’s response

I reported this issue to Facebook under their responsible disclosure program, which I’ve had successful experiences with before. Here’s their official response:

Friendly and descriptive as always (I love participating in Facebook’s bounty program), they told me this would be deemed a won’t-fix, and is actually intentional behavior. I was puzzled: How can Facebook let this happen? Whilst it’s not possible to get links for a specific user, you could easily run through results all day* until you find something interesting.

Timeline

> 29th of May: Me: Reported through Facebook’s whitehat tool.

*Yes, Facebook does block excessive requests but there are ways to bypass that, e.g., using multiple access tokens and if needed, VPNs. Rate limiting won’t stop someone who is determined.

Are the links we send being tracked this way? I have absolutely no idea, but now at least we know they could be.

FAQ

• When is a link scraped and stored in Facebook’s database?

  
  

  From my testing I assume that a link is stored in Facebook’s database from the moment someone actually clicks it on Facebook. This does not apply to links shared through Facebook which no one clicks on.
• Does it matter where or how we share a link?

  
  

  As far as I know, this does not matter: Links shared through messenger, private groups, status updates, or by using the mobile application seem to be vulnerable to the methods described.
• Do links even matter? I don’t care if someone sees the links I shared.

  
  

  Links sometimes include personal stuff without you even knowing. See “Why this is a big deal” above.
• Why are you making this issue public?

  
  

  Facebook clearly stated that this is an intended behavior and I respect their decision, however, I think it is our right to know who can see the data we share. Are the links we send being tracked this way? I have absolutely no idea, but now at least we know they could be. Just keeping my mouth shut won’t help.
• If I share a link on Facebook, what’s the actual chance someone will actually see it using this “intended behavior?”

  
  

  There are lots of objects on Facebook and it would be a really hard, if not impossible, to scan all of them using the API. You would be really unlucky if an attacker stumbled upon the number linking to your secret link, but the odds increase if attackers start monitoring these numbers on a regular basis. In about ten minutes, I was able to extract 70 links. Facebook does have some rate limiting in place to prevent this type of abuse but as mentioned above, it is possible to bypass that.
• Are you mad at Facebook?

  
  

  Not at all. Facebook has one of the best bug bounty programs available to hackers. I respect their decision, but I also think it’s our right to be informed of the design decisions which may impact our privacy.
• I found a vulnerability in Facebook. Where do I start?

  
  

  Cool! Make sure you read their bug bounty rules and are reporting a valid bug. After reporting the issue here, they may decide to honor you in their Hall of Fame and reward you with a bounty starting at $500.
• Who are you?

  
  

  I’m Inti and I live in Oilsjt, Belgium—the country known for its beer, fries, chocolate, and terrorists. As a kid, I was extremely skilled at breaking stuff. I’m 21 now, a student, and still doing more or less the same being an ethical hacker with references at Google, Facebook, Microsoft $MSFT, Yahoo, and so on.

This post originally appeared at Medium.