Hacker Discovers Bug that Allows Anyone Bypass Facebook 2FA
Meta discovered a bug that allowed users to manage their logins on Facebook and Instagram. This could have allowed malicious hackers access to an account’s two factor protections by simply knowing their phone number.
Gtm Manoz is a security researcher from Nepal who realized that Meta didn’t set a limit on how many attempts a user could enter the two-factor code to log in to their accounts using the new Meta Accounts Center. This allows users to link all their Meta accounts such as Instagram and Facebook.
An attacker would need the victim’s phone number in order to access the central accounts center. They would then link the victim’s Facebook account to that number and then brute-force the two-factor SMS code. Because there was no limit on how many attempts an attacker could make, this was crucial.
