Hacker Demonstrates Facebook Account Hack, Gets $15,000 Reward

There are several ways to hack a Facebook account and social engineering is the most used, but a major flaw discovered by a security researcher left millions of Facebook users at risk before getting patched by Facbook. Although the flaw was detected on Facebook’s beta site (beta.facebook.com) used mainly by developers to test apps before being deployed to the main site, the risk posed by the bug could have led to a widespread account hijack which would’ve affected many users.



Anand Prakash, the researcher who detected the bug, since been rewarded by Facebook with a sum of $15,000.

This is how it works

When you use the “Forgot password” feature on Facebook, a 6-digit code is sent to your mobile phone which acts as a temporary PIN to access the site and reset your password. He discovered that one could enter this 6-digit passwords repeatedly on the beta site without limit. With brute-force attack, a potential hacker may keep trying random numbers till access is granted.

On the regular Facebook website, there’s a limit set on the number of times you can try wrong codes before the account gets blocked. On the beta site, however, this brute-force protection isn’t present. This gives a potential hack more than enough chances to carry out an attack.

On his website, he posted a video demonstration on how this works.

Responding to this, Facebook said in a statement:

One of the most valuable benefits of bug bounty programs is the ability to find problems even before they reach production. We’re happy to recognize and reward Anand for his excellent report.

Prakash reported the bug to Facebook on February 22 and it was patched the following day. Facebook has reportedly paid up to $4.3 million to over 800 hackers and security researchers since 2011 for discovering such security flaws.