- Google reportedly gathering millions of Americans’ personal health records 12 Months Ago
- Trina goes off on Walmart shopper who allegedly called her the ‘N-word’ Today 4:14 PM
- Bored of Helvetica? iOS users finally have some new font options Today 4:00 PM
- Amid panic, YouTube says new terms of service won’t impact creators Today 3:56 PM
- Opposing sides fight to control online narrative over Bolivian ‘coup’ Today 3:50 PM
- How to sign up for the Disney+ bundle Today 3:35 PM
- Instagram covers video costs for celebs who don’t get political Today 3:30 PM
- T.I.’s daughter apparently unfollowed her dad on Instagram after hymen comment Today 3:26 PM
- Meet ByteDance, the Chinese tech company behind TikTok Today 3:09 PM
- Everything you need to know about investing app Robinhood Today 2:44 PM
- How to stream 49ers vs. Seahawks on Monday Night Football Today 1:43 PM
- Cops cuff Black man for eating sandwich on subway platform Today 1:29 PM
- Drake booed offstage by Frank Ocean fans Today 1:17 PM
- Trump says he’s meeting with vaping industry as administration readies new rules Today 12:42 PM
- Everything you need to know about Google Reverse Image Search Today 12:29 PM
A cybersecurity company revealed Monday details surrounding a vulnerability that could have exposed data on Facebook users.
The bug, connected to Facebook’s Search system, was patched by the social media site in May after being reported by Ron Masas, a security researcher with Imperva.
Masas discovered that the search feature was vulnerable to cross-site request forgery attacks, which could allow a malicious website to gather data on a Facebook user while they’re logged in.
“This allowed information to cross over domains—essentially meaning that if a user visits a particular website, an attacker can open Facebook and can collect information about the user and their friends,” Masas said, according to Brinkwire.
While testing out the attack, Masas was able to determine specific data on users and their friends regardless of one’s privacy settings.
Information obtained included, among other things, whether a user had taken a photograph in a certain location or had friends of a certain religion.
“Similar queries can be composed to extract data about the user’s friends,” Masas said. “For example, by searching ‘my friends who like Imperva’ I can check if the current user has any friends who like the Imperva Facebook page.”
Masas added that the vulnerability was especially dangerous for mobile phone users, who may not even notice a new browser tab opening when the attack takes place.
In a statement to The Verge, Facebook stated that such an attack would affect other websites as well, not just its own.
“As the underlying behavior is not specific to Facebook, we’ve made recommendations to browser makers and relevant web standards groups to encourage them to take steps to prevent this type of issue from occurring in other web applications,” Facebook said.
The social media company also denied seeing any evidence that the attack was exploited prior to Masas’ discovery.
News of the bug comes amid increased scrutiny for Facebook following a string of data privacy scandals.
Facebook was recently fined $641,000 by a British watchdog over its involvement in the Cambridge Analytica scandal, which saw data on as many as 87 million Facebook users handed over to third parties.
Mikael Thalen is a tech and security reporter based in Seattle, covering social media, data breaches, hackers, and more.