- Hong Kong protesters knock down alleged ‘facial recognition tower’ 9 Months Ago
- PewDiePie becomes the first YouTuber to hit 100 million subscribers Today 11:35 AM
- ‘Breaking Bad’ movie will show us what happened to Jesse Pinkman Today 9:39 AM
- How to stream ROH Wrestling’s Honor For All Today 7:30 AM
- How to stream Steelers vs. Titans in NFL preseason action Today 7:00 AM
- How to stream ‘Good Eats: The Return’ online Today 7:00 AM
- How to stream ‘Power’ season 6 Today 6:00 AM
- Your best bets for finding discounted and refurbished Airpods Today 6:00 AM
- How to stream Barcelona vs. Real Betis Saturday 11:31 PM
- How to stream Tottenham Hotspur vs. Newcastle Saturday 11:21 PM
- All of the ‘Avengers: Endgame’ Easter eggs discovered by fans Saturday 6:52 PM
- Every big announcement made at D23 about Disney+ Saturday 6:33 PM
- The best haunted house movies to watch online in 2019 Saturday 4:13 PM
- Andy Ngo seen laughing as Patriot Prayer members plan an attack in newly emerged video Saturday 3:59 PM
- How to stream Manchester City vs. Bournemouth Saturday 3:25 PM
A cybersecurity company revealed Monday details surrounding a vulnerability that could have exposed data on Facebook users.
The bug, connected to Facebook’s Search system, was patched by the social media site in May after being reported by Ron Masas, a security researcher with Imperva.
Masas discovered that the search feature was vulnerable to cross-site request forgery attacks, which could allow a malicious website to gather data on a Facebook user while they’re logged in.
“This allowed information to cross over domains—essentially meaning that if a user visits a particular website, an attacker can open Facebook and can collect information about the user and their friends,” Masas said, according to Brinkwire.
While testing out the attack, Masas was able to determine specific data on users and their friends regardless of one’s privacy settings.
Information obtained included, among other things, whether a user had taken a photograph in a certain location or had friends of a certain religion.
“Similar queries can be composed to extract data about the user’s friends,” Masas said. “For example, by searching ‘my friends who like Imperva’ I can check if the current user has any friends who like the Imperva Facebook page.”
Masas added that the vulnerability was especially dangerous for mobile phone users, who may not even notice a new browser tab opening when the attack takes place.
In a statement to The Verge, Facebook stated that such an attack would affect other websites as well, not just its own.
“As the underlying behavior is not specific to Facebook, we’ve made recommendations to browser makers and relevant web standards groups to encourage them to take steps to prevent this type of issue from occurring in other web applications,” Facebook said.
The social media company also denied seeing any evidence that the attack was exploited prior to Masas’ discovery.
News of the bug comes amid increased scrutiny for Facebook following a string of data privacy scandals.
Facebook was recently fined $641,000 by a British watchdog over its involvement in the Cambridge Analytica scandal, which saw data on as many as 87 million Facebook users handed over to third parties.
Mikael Thalen is a tech and security reporter based in Seattle, covering social media, data breaches, hackers, and more.