In the Meta for Business Ad Partnership hub, https://business.facebook.com/partnership_ads_hub/ad_content there are tools available to see insights for content of partners. It is possible to use the partnership_ads_hub_content_details in GraphQL to view insights for any professional Instagram account post. new…
If an Instagram user tries to access the Shared Login screen in the mobile app and does not pass gating, the IGBloksAppRootQuery Graphql call will fail for the blok app com.bloks.www.async.components.ig_permissions.account_owner.onboarding_landing_screen with a traceback of internal paths The response contained internal traceback information related to gating and privacy checks. Timeline Nov 8,…
The AdsLeadGenLeadRetrievalEmailModalContainerQuery GraphQL query has a field page_admins_with_manage_leads_access with no access control on it, leading to disclosure of a Facebook page admin as well as their personal email address. 1. Login to facebook.com as Attacker 2. Open Chrome Developer Tools and insert the following script for a GraphQL query require("AsyncRequest"); new…
When using Meta Rayban glasses for image detection, a photo is captured and then uploaded to rupload.facebook.com/photoshub_upload_media_ar_chunked_everstore. If the mmai activity in the request header isn t set correctly, the upload will fail with an error disclosing internal paths. Timeline Oct 16, 2024 – Report sentOct 21, 2024 – Report triaged by MetaOct 24, 2024 – Bounty Continue reading…
This post investigates the behavior of Everstore video uploads when interacting with Meta’s Graph API. Everstore, Meta s proprietary blob storage system, handles a variety of data types, including video files. Through testing, it was observed that videos uploaded from Everstore can be disclosed via the /me/videos endpoint. Despite receiving an error message during the upload Continue reading…
In Oculus, users are given the option to buy gift cards, there is a new feature coming up that uses AI prompts to generate a background. However, since, they use oil_handles to generate the background, any user can access any user s oil_handle to retrieve the source URL for the AI generated image. Oil handles do Continue reading Meta AI oil_handles used in Oculus Gift card background generation do…
Meta AI Studio had a vulnerability that allowed anyone with a Facebook account to upload explicit images and use the AI to generate even more explicit content. Here s how I found it, exploited it, and what it means for content moderation in AI. Meta’s AI Studio is a tool that lets users upload images and Continue reading I Found a Bug in Meta AI That Let Me Upload Explicit Content and Have AI…
In Facebook Graph API as defined by the developer documentation, there are several access tokens, to authenticate against various API endpoints. User Access Tokenmake requests on behalf of the user, normally obtained via OAuth facebook.com/dialog/oauth Page Access Tokenmake requests on behalf of the page, obtained via graph.facebook.com/pageID?fields=access_token Client Tokenused for app level…
Meta Rayban Stories has lower-level settings to change via the View (Assistant app) for example enable Assistant change inner LED notification level change volume Since the method for these settings are shared for other options defined in the firmware, it is possible to replace with a setting to change the duration of a video capture Continue reading Bypass video capture limit on Ray-Ban Stories…
There is a XController that allows information to be returned about an Instagram user. This feature discloses the country of a private account. Even if this feature is an ad tool, this does not support the privacy of a private account. Additionally the owner has no way of being aware their location is disclosed like Continue reading View the country of a private Instagram User The post View the…