e-Sentinel Security Advisory - Ref: Session Hijacking iPhone Facebook Application ver 3.1.2

[bill.robson@xxxxxxxxxxxxxx]

Tested on
iPhone firmware version 3.1.2
Facebook App version 3.1.2

Impact
It is possible to usurp valid session IDs in order to gain unauthorised access 
to facebook profiles. At greatest risk are those handset that have been 
jailbroken.

Description
Using known vulnerabilities and exploits to gain remote or direct access to the 
handset's file system, it is possible to steal the files:

/private/var/mobile/Applications/<install 
directory>/Library/Preferences/com.facebook.Facebook.plist

/private/var/mobile/Applications/<install 
directory>/Library/Cookies/Cookies.plist

Once these files are copied and installed on to a separate handset, the 
attacker is able to use the victim's Facebook account unhindered.

Exploit
Known vulnerabilities exist in order to gain access to the iPhone's file 
system, after which no exploit code is required.

Workaround/Fix
No known fix is known. To lessen the risk of this occurring, users should avoid 
Jailbreaking their handsets.