![]() The statement echoes Facebook's explanation on Tuesday of the vulnerability that enabled an actor to scrape data from more than 500 million users: “We made changes to prevent malicious actors from using software to imitate our app and upload large sets of phone numbers to see which ones matched Facebook users.”įacebook has consistently emphasized this week that stopping scrapers is an endless cat-and-mouse game. In its official acknowledgement of the Instagram contact import vulnerability, Facebook wrote, “This could have let a malicious user imitate Instagram and look up phone numbers to find which users they belonged to.” ![]() “After I talked with Forbes, they realized they made a mistake, fixed the issue, and paid me a small bounty of $4,000.” “At the beginning Facebook refused to acknowledge my report as legit, even after I provided them a full proof of concept,” told WIRED on Thursday. In September 2019, Forbes broke the news about disclosure saga. Initially, though, Facebook told that enumeration vulnerabilities are “extremely low risk” unless they specifically "allow an attacker to determine which specific user ID an email address or mobile phone number is linked to,” which finding did. ![]() Facebook eventually said in September 2019 that its security team was “already aware of the issue due to an internal finding.” But a researcher who goes by submitted a vulnerability report in August 2019 about a bug in Instagram's contact import feature that could pull user data through a phone number enumeration attack that was even more automated and efficient than the one De Ceukelaire demonstrated in 2017. ![]() Facebook has not yet explained the specific technical mechanism that enabled its creation. The feature is set to “Everyone” by default.Īnd then there's the now public 2019 user data trove. Go to “Settings & Privacy,” “Settings,” “Privacy,” and scroll to “How People Find and Contact You” to find the “Who can look me up” email address and phone number controls. The options were “Everyone,” “Friends of friends,” and “Friends.” In May 2019 the company added an “Only me” option. Even if your phone number is set to “Only me" on your profile, it could still be set to “Everyone” under “Who can look me up.” In that case, if someone guessed your phone number they would be able to link it to your other public Facebook information.Īt the time of De Ceukelaire's research, Facebook didn't even offer an “Only me” option within the “Who can look me up” control. De Ceukelaire further flagged that users might not understand that the privacy controls they set for information on their Facebook profile could be undermined by another Facebook privacy setting known as “Who can look me up.”įacebook lets you set your phone number and email address as visible to “Only me.” But it also has an entirely separate setting, called “Who can look me up,” that dictates whether someone can find you on Facebook using your phone number or email address through the contact import tool. Facebook told De Ceukelaire at the time that it might revise its rate limits-the maximum numbers of submissions one can make-for the contact import feature, but that it did not view the issue as a vulnerability. First, attackers might well look for more powerful and efficient ways of abusing the contact import feature through phone number enumeration attacks. The researcher had raised two crucial points, though. “But it’s a recurring theme for Facebook that whenever growth is at stake, they will think twice about fixing something to benefit the user’s privacy.”Īshkan Soltani, former FTC chief technologist It's not just Facebook," says Inti De Ceukelaire, a Belgian security researcher who reported a vulnerability in Facebook's contact import feature to the company in 2017. “I'm sure other companies are sweating as well now. But Facebook's contact import tool in particular has had a number of known problems, and supposed fixes, over the years. Many social networks and communication apps offer some version of this as a sort of social lubricant. But now researchers are saying Facebook knew about similar vulnerabilities for years before that, and it could have made a far greater effort to prevent the mass scraping in the first place.Īt issue is Facebook's “content importer,” a feature that combs a user's address book to find people they know who also use Facebook. It took days for Facebook to finally acknowledge the root cause, an issue the company says it fixed in 2019. The profile names, email addresses, and phone numbers of over 500 million Facebook users have been circulating publicly online for nearly a week.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |