Sometimes the biggest exploits come from the smallest of places.
This turned out to be the case for Facebook, as researcher/computer whiz Dan Melamed managed to find a simple trick that lets a user turn off comments - and outright delete - videos uploaded by someone else.
The exploit Melamed reported is deceptively straightforward. The basic explanation is that while uploading their own video to an event page, a user can change the video's ID number mid-post to that of another user's video.
This results in the targeted video being uploaded instead, along with the unintended user now having control over it. This would allow them to either disable comments or delete the video entirely, just as if they were authorized by the video's original owner.
The icing on the cake? For his efforts, Melamed was awarded a $10,000 bounty by Facebook shortly after showing the social media company the exploit.
Via Gizmodo
