The social media giant’s mobile applications use certificate pinning and other security mechanisms to protect communications between the application running on a user’s device and Facebook’s servers. While these measures significantly improve security, they also make it harder for researchers to find server-side vulnerabilities in the company’s apps.
That is why — based on feedback it has received from white hat hackers — Facebook has decided to introduce new settings that researchers can enable on their own accounts so that they can analyze network traffic associated with the Facebook, Messenger and Instagram applications when searching for vulnerabilities they can report through the company’s bug bounty program.
Leave a reply
