e-Sentinel Security Advisory - Ref: Session Hijacking iPhone Facebook Application ver 3.1.2

[bill.robson () e-sentinel com]

Tested on
iPhone firmware version 3.1.2
Facebook App version 3.1.2

Impact
It is possible to usurp valid session IDs in order to gain unauthorised access to facebook profiles. At greatest risk 
are those handset that have been jailbroken.

Description
Using known vulnerabilities and exploits to gain remote or direct access to the handset's file system, it is possible 
to steal the files:

/private/var/mobile/Applications/<install directory>/Library/Preferences/com.facebook.Facebook.plist

/private/var/mobile/Applications/<install directory>/Library/Cookies/Cookies.plist

Once these files are copied and installed on to a separate handset, the attacker is able to use the victim's Facebook 
account unhindered.

Exploit
Known vulnerabilities exist in order to gain access to the iPhone's file system, after which no exploit code is 
required.

Workaround/Fix
No known fix is known. To lessen the risk of this occurring, users should avoid Jailbreaking their handsets.