Mark Zuckerberg Facebook Hacked By Security Expert Khalil Shreateh To Prove Vulnerability

There are bugs in Facebook's innerworkings that even CEO Mark Zuckerberg wasn't prepared for. That's why Palestinian researcher and security expert Khalil Shreateh took it into his own hands to expose it. In order to get the attention he claims Facebook staff lacked when he reported the issue, he hacked Zuckerberg's personal Facebook page to demonstrate. The bug apparently allows other users to post on the timelines of those who they are not Facebook friends with, which is exactly what Shreateh did to Zuckerberg.

"First, sorry for breaking your privacy and post(ing) to your wall," wrote Shreateh, who lives in the West Bank city of Hebron. "I (have) no other choice to make after all the reports I sent to (the) Facebook team," he wrote on the CEO's timeline.

Shreateh, an unemployed security researcher with a degree in information systems said he discovered the glitch when he found that entering some website URLs, finding a user's Facebook ID and doing a little copy and pasting -- albeit in places most users wouldn't think to do so in -- a user could essentially post on everyone's timeline, even people who weren't their friends on the social media site.

After exchanings a series of emails with Facebook staff, the first of which he got a response back saying his findings weren't a bug and a couple of others in which the staffer could not find the content he was talking about -- including posting an Enrique Iglesias video to the Timeline of a woman who went to college with Zuckerberg -- he decided to see if he could access Zuckerberg's own page.

The success of his post led to Facebook amending the bug Thursday. Matthew Jones, Facebook software enigneer, defended the inaction of the site upon first receiving Shreateh's report on the blog Hacker News. He claimed the initial report was poorly worded, which led to a misunderstanding between staff and Shreateh. He admitted, however, that Facebook staff should have pursued the issue further.

"We should have asked for additional repro [reproduction] instructions after his initial report," he wrote. "Unfortunately, all he submitted was a link to the post he'd already made ... Had he included the video initially, we would have caught this much more quickly."