Shulou(Shulou.com)11/24 Report--

CTOnews.com, January 31 (Xinhua) Security researchers from Nepal recently found new vulnerabilities in the login system of Meta's Facebook, Instagram and other applications, and anyone can bypass Facebook's two-factor authentication.

Researcher Gtm M ä n ô z told TechCrunch: "anyone can take advantage of this loophole and bypass SMS-based two-factor authentication as long as they know the phone number of the other party."

M ä n ô z indicates that this vulnerability exists in the Meta Group's unified login system, where Meta does not set a limit on attempts when users enter a two-factor code to log in to their account.

This means that you only need to know the phone number or email of the target, so the attacker can enter the two-factor SMS code by brute force cracking. Once the attacker gets the correct CAPTCHA, the attacker can carry out subsequent attacks.

CTOnews.com learned that even after a successful attack, Meta alerts users that the account is linked to someone else's account, so two-factor authentication is disabled.

M ä n ô z reported the bug to the company last year, and Meta has now fixed the vulnerability. Meta eventually paid him $27200 (currently about 184000 yuan) for his discovery.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.