Social Me Still Too Social

Social Me is another Facebook application that was recently banned, then more recently reinstated.  I’m not sure exactly why they were banned to start with, but they ought to know their application still has a gaping security hole.  I hadn’t experimented with Social Me much before, but when I saw they were back online I thought I would check for any remaining issues.

I noticed some suspicious aspects in the application’s code fairly quickly, and after an hour or two of tinkering, I successfully found a way to send messages on behalf of any user.  I am able to send a message to anyone and make it appear to be from anyone else.  This also includes sending flirts, slaps, “interested in you” notes, etc. – pretty much any of the means of communication Social Me offers.  (The trick also makes it quite easy to drive up one’s “score.”)

The “hack” involved is unbelievably simple, because the AJAX interface for Social Me is totally unsecured.  And it’s not even a POST request – I just enter a certain URL in my browser with a few query strings modified accordingly.  The server does nothing to validate who is making the request.  It reminds me of my original Emote hack.

Proof offered on demand – send me your Facebook ID, the Facebook ID of someone you can check with, and a test message.  And developers, take heed – basic coding practices can prevent this kind of problem.

Update (July 17): Well that was quick.  After a commenter requested a demonstration message, I found the hack had stopped working.  Checking the code for Social Me I discovered that the developers have now added an MD5 hash to their AJAX requests as a means of authentication.  Kudos to them for patching the hole so quickly.