- CLIF Bar and KIND Snacks are in a bizarre social media war Today 2:55 PM
- Caillou is how tall? Today 1:32 PM
- No, that video of a Boston Dynamics robot attacking its creators is not real Today 12:40 PM
- Alex Jones places $1 million bounty on culprit who planted child porn on his InfoWars server Today 12:03 PM
- ‘Stranger Things’ star’s new Netflix prank show is receiving backlash Today 9:04 AM
- How to watch ‘City on a Hill’ for free Today 8:00 AM
- How to watch ‘Euphoria’ for free Today 7:00 AM
- Meet the home brewer turning beer into a case for net neutrality Today 6:30 AM
- How to watch the U.S. vs. Chile at the World Cup for free Today 6:15 AM
- 15 teen movies on Netflix that will make you laugh, cry, and cringe Today 6:00 AM
- How to watch Estrella TV online for free Today 5:00 AM
- People are roasting this ‘traditional’ take on marriage with a hilarious meme Saturday 5:17 PM
- The internet just collectively realized that the Neopets of the world must be hungry Saturday 4:00 PM
- Alt-right message board 8chan was served a search warrant Saturday 3:06 PM
- O.J. Simpson just joined Twitter in the most bizarre fashion Saturday 1:20 PM
Facebook patches vulnerability that could have exposed user data
Social media site denies bug was exploited
A cybersecurity company revealed Monday details surrounding a vulnerability that could have exposed data on Facebook users.
The bug, connected to Facebook’s Search system, was patched by the social media site in May after being reported by Ron Masas, a security researcher with Imperva.
Masas discovered that the search feature was vulnerable to cross-site request forgery attacks, which could allow a malicious website to gather data on a Facebook user while they’re logged in.
“This allowed information to cross over domains—essentially meaning that if a user visits a particular website, an attacker can open Facebook and can collect information about the user and their friends,” Masas said, according to Brinkwire.
While testing out the attack, Masas was able to determine specific data on users and their friends regardless of one’s privacy settings.
Information obtained included, among other things, whether a user had taken a photograph in a certain location or had friends of a certain religion.
“Similar queries can be composed to extract data about the user’s friends,” Masas said. “For example, by searching ‘my friends who like Imperva’ I can check if the current user has any friends who like the Imperva Facebook page.”
Masas added that the vulnerability was especially dangerous for mobile phone users, who may not even notice a new browser tab opening when the attack takes place.
In a statement to The Verge, Facebook stated that such an attack would affect other websites as well, not just its own.
“As the underlying behavior is not specific to Facebook, we’ve made recommendations to browser makers and relevant web standards groups to encourage them to take steps to prevent this type of issue from occurring in other web applications,” Facebook said.
The social media company also denied seeing any evidence that the attack was exploited prior to Masas’ discovery.
News of the bug comes amid increased scrutiny for Facebook following a string of data privacy scandals.
Facebook was recently fined $641,000 by a British watchdog over its involvement in the Cambridge Analytica scandal, which saw data on as many as 87 million Facebook users handed over to third parties.
Mikael Thalen is a tech and security reporter based in Seattle, covering social media, data breaches, hackers, and more.