安全研究人员加雷思·赖特“偶然发现”了一种让一台iOS或Android设备认为自己登录了另一台设备的Facebook帐户的方法。显然，该方法也适用于Dropbox，即下一个Web报告。只要从你的iOS或Android设备上复制一个“plist”并粘贴到另一个设备上的同一个目录（使用像iExplorer这样的免费Mac应用程序），任何人都可以轻松地让Facebook和Dropbox（可能还有其他一些应用程序）认为他们就是你。就这么简单。Facebook就此事发表声明：

Facebook's iOS and Android applicati*** are only intended for use with the manufacture provided operating system, and access tokens are only vulnerable if they have modified their mobile OS (i.e. jailbroken iOS or modded Android) or have granted a malicious actor access to the physical device. We develop and test our application on an unmodified version of mobile operating systems and rely on the native protecti*** as a foundation for development, deployment and security, all of which is compromised on a jailbroken device. As Apple states, "unauthorized modification of iOS could allow hackers to steal personal information ... or introduce malware or viruses." To protect themselves we recommend all users abstain from modifying their mobile OS to prevent any application instability or security issues.

虽然Facebook的声明似乎暗示你可能需要运行一个越狱或根设备来实现这一点，但事实并非如此。即使你的iOS设备没有被越狱，并且上面有密码，你的访问令牌和OAuth密钥都是可用的，这意味着任何人只要将这些文件复制到他们的设备上，就可以进入你的Facebook帐户，以及任何使用你的板载Facebook凭据的应用程序（比如DrawSomething）。

因此，如果一个有恶意意图的人进入你的设备，Facebook承认他们可以刷你的访问令牌。怎样？因为Facebook将这些代币存储在未加密的纯文本文件中。虽然小偷在查看你的电子邮件、联系人和银行账户信息之前抢夺你的Facebook代币的情况不太可能发生，但黑客攻击仍然存在。Next Web的Matthew Panzarino使用位于Facebook和Dropbox中的plists成功复制了Wright的实验，并指出即使你没有丢失**，你仍然可能处于危险之中：

If a program was running on a public computer, or if someone had modified a public charging station to siphon off the plain-text .plist file, they could theoretically gain access to that information, whether you're jailbroken or not.

尽管这两种情况似乎都不太可能发生，但赖特并没有那么确信。他对特尼卡说：

The scenario is something that happens a lot at universities and workplaces as users charge their devices.

赖特告诉ZDnet，Facebook目前正在进行修复，但和往常一样，如果你的设备被盗，一个简单的远程擦除将减轻任何丢失数据的担忧。他在自己的网站上给出了最后一句警告：

The biggest risk is from malware and viruses designed to slurp data from devices plugged into PC's, so despite what any other articles say; jailbroken or not you ARE vulnerable!

目前，请密切关注可疑的充电站。

更新：Dropbox已就此事发表声明：

Dropbox's Android app is not impacted because it stores access tokens in a protected location. We are currently updating our iOS app to do the same. We note that the attack in question requires a malicious actor to have physical access to a user's device. In a situation like that, a user is susceptible to all sorts of threats, so we strongly advise safeguarding devices.