Attacker could have hijacked any account he wanted
http://i1-news.softpedia-static.com/images/fitted/340x180/facebook-fixes-bug-that-allowed-users-to-set-new-passwords-for-other-accounts.png
Mar 7, 2016 17:05 GMT · By Catalin Cimpanu Facebook has paid $15,000 (€13,600) to an independent security researcher who discovered a simple way of resetting passwords for other accounts, setting a new passphrase and effectively taking over profiles.
The developer who discovered this issue and helped Facebook fix it before being abused by a nefarious actor is Anand Prakash, a security researcher based in Karnataka, Bangalore in India.
As he describes on his blog, the issue is actually a trivial brute-force attack on the password recovery form, and not on the main Facebook site, which is protected against such types of automated attacks.
Full Article
