Update 31.07.2020
Fanpage checkout tickets are now good to go! For more info, see this post.
Original message:
Until further notice, we’re halting all Fanpage listings for security reasons.
Just a few years ago, the hidden admin trick allowed malicious Fanpage sellers to regain control over a sold Facebook Fanpage, at a later on date. There were actually a few methods (most of them are patched now) that allowed old owners to regain access. The one I am personally familiar with was the disabled profile method. The method was quite simple, add an admin invite to a FB account you control, then disable the account. From the Fanpage end, you wouldn’t see the pending invite. Once the malicious seller sold the page he would simply reactivate the profile and the invite would show up again (and still be valid). As you can imagine, such exploits caused tons of people to become victims, as there was no easy way to defend against them.
It seems a similar method is back online, and we’ve just witnessed it working first hand. We don’t want to reveal the username of our SWAPD member who currently knows this exploit, but he helped us test and validate this method for which we’re thankful for.
What can you do to protect yourself?
Adding a business manager may help you keep your page, but you will still have a hidden admin in the background who will be able to change every setting of your page. So, with this particular method, you’re not safe just by adding a business manager. But we still recommend adding your page to your FB business, this way at least you won’t lose ownership.
Can you be removed as admin by a hidden admin?
Yes, once the 7-day rule passes, the hidden admin will be able to remove/add anyone he/she pleases.
What can we do to fix this?
Even though we were advised not to go public with it, we’re doing the exact opposite. Especially since we’ve found out that this was already reported to the bug bounty hunters over @Facebook and they’ve said they don’t consider this an exploit. Our admins already filed another report, we are waiting for a response.
How does the method work in detail?
Nice try. We will not reveal this.
How can I check if I have a hidden admin.
We are working on a tutorial and should have one ready by tonight/tomorrow. See also Goofy’s response.
So are Fanpage sales over on SWAPD?
No! We just need to make sure we find the most effective (and easy) way of checking for hidden admins so we can vet things during sales. We hope to have a solution really soon.
So, until then, all Fanpage listings are no longer valid. If you have any open tickets, you’re entitled to back out from them.
Be safe
