Facebook squashes bug that let anyone delete any picture or animation

By Mark Coppock Published November 28, 2017

If you’re putting your life out there on Facebook, then you’re probably hoping your priceless images remain around for all posterity. At the very least, you want to be the one to remove them from the site should you decide they contradict your recent conversion to Buddhism. Fortunately for you and every other Facebook user, a bug was discovered and fixed that would have allowed anyone to easily delete your pictures and animated GIFs.

As reported by Security Week, the flaw was identified by Iranian security researcher Pouya Darobi, who was taking a look at a new Facebook polling feature and discovered a simple method for deleting any image or animation posted on Facebook. Thanks to Facebook’s generous bug bounty program, which put $10,000 in Darobi’s bank account, the bug was promptly reported and Facebook implemented a temporary fix on November 3, the day the bug was reported. A permanent fix came out on November 5.

Recommended Videos

At the heart of the program was a new polling feature that Facebook rolled out at the beginning of November. The feature allows users to create polls and add pictures and GIF animations. The poll creation process generates code that includes the unique image identification number for each picture and animation that is included with the poll.

If the poll post was subsequently deleted, then the images were deleted as well. The problem was caused by the ability to replace the image ID in the code with that of any other image on Facebook, including images owned by other users. Deleting the post deleted those images as well.

This is not the first bug that allowed users to delete Facebook materials. Other bugs have been discovered by researchers, like Darabi, that allowed the deletion of comments, videos, and photos. Like this bug, the method in many instances revolved around simply replacing the asset ID.

Darabi has made a pretty penny reporting bugs to Facebook, with a bug reported in 2015 that netted him $15,000 from the social media giant and $7,500 for another bug reported in 2016. All told, Facebook has shelled out well in excess of $5 million in its bug bounty program. It’s enough to make you want to spend some time locking down your Facebook account.

Former Computing Writer

Mark Coppock is a Freelance Writer at Digital Trends covering primarily laptop and other computing technologies. He has…

Topics

Computing

AI agents are acting like rogues and causing a huge headache for US banks

US banks block AI agents over fears they could make unauthorised financial moves

Banking

US banks are facing a new kind of digital headache: artificial intelligence agents attempting to access customer accounts and perform actions that may go beyond what users intended. As AI tools become more capable of navigating websites and carrying out tasks independently, financial institutions are scrambling to prevent them from crossing security boundaries.

According to a report published by Axios on October 22, major US banks have detected third-party AI agents operating inside customer accounts without authorisation. Some agents reportedly appeared to attempt actions independently of user instructions. The banks involved have not publicly detailed every incident, and there is no evidence that the reported activity resulted in widespread theft of customer funds.

Computing

Canva enters the AI image generation race with Craft, and it’s thinking beyond pretty pictures

The new model plans layouts before generating images, with precise editing and support for 30 aspect ratios.

Canva Craft Featured Image

AI can generate all kinds of pretty pictures, but getting it to spell a headline correctly or keep a poster's layout intact can be another story. Canva wants to fix that with Canva Craft, its first in-house image generation model. Rather than focusing primarily on photographs, Craft is designed around the posters, presentations, social media graphics, and other visual content people actually create. The goal is simple: spend less time fixing AI's mistakes and more time making something useful.

Canva Craft plans before it generates

Computing

Mori might be the cutest AI companion robot yet, and it reacts to you like a pet

The Pokémon-like companion can blink, dance, act shy, and respond to what is happening around it.

OKA Mori The Nature Companion AI Home Robot

With AI progressing so fast, it's only a matter of time before we start getting AI companions like the ones we used to see in movies like R2-D2, Wall-E, or Baymax. Now, Singapore-based OKA Technology has unveiled Mori, a cute little AI companion that looks less like a conventional home robot and more like someone turned the Pokémon Foongus into a table lamp.

Mori isn't meant to clean your house or control your smart home, but to serve as what OKA calls a "Nature Companion." It uses subtle movements, warm lighting, nature-inspired sounds, and small reactions to make its presence around the house feel calming rather than distracting. Mori can sit quietly while you read, sway along to music, welcome you when you enter a room, or encourage you to slow down for a moment without requiring a screen or a conversation.