Facebook leaked keys to account data: Symantec
By Agence France-Presse, Updated: 5/11/2011
US computer security firm Symantec has said that Facebook accidentally left a door open for advertisers to access profiles, pictures, chat and other private data at the social network.
Facebook leaked keys to account data: Symantec
US computer security firm Symantec has said that Facebook accidentally left a door open for advertisers to access profiles, pictures, chat and other private data at the social network.
Facebook told AFP that there was no evidence anyone stepped through that door and swiped any information from the accounts of its more than 500 million members.
Symantec discovered that certain Facebook applications leaked tokens that act essentially as “spare keys” for accessing profiles, reading messages, posting to walls or other actions.
Facebook applications are Web software programs that are integrated onto the leading online social network’s platform. Symantec said that 20 million Facebook applications, such as games, are installed every day.
“We appreciate Symantec raising this issue and we worked with them to address it immediately,” Facebook said in response to an AFP inquiry.
The tokens were being leaked to third-party applications including advertisers and analytics platforms, allowing them to post messages or mine personal information from profiles, according to Nishant Doshi of Symantec.
“Fortunately, these third-parties may not have realized their ability to access this information,” Doshi said in a blog post.
“We have reported this issue to Facebook, who has taken corrective action to help eliminate this issue.”
Symantec estimated that as of April, nearly 100,000 applications were giving away keys to Facebook profiles.
“We estimate that over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties,” Doshi said.
Facebook confirmed the problem, which was discovered by Doshi and Symantec colleague Candid Wueest, according to the computer security firm.
But Facebook said the Symantec report had a few “inaccuracies.”
There was no evidence that the problem resulted in private information being gleaned from Facebook members’ accounts, according to the California-based social networking service.
“In addition, this report ignores the contractual obligations of advertisers and developers which prohibit them from obtaining or sharing user information in a way that violates our policies,” Facebook said.
There was no reliable estimate of how many tokens have been leaked since the release of Facebook applications in 2007.
Despite whatever fix Facebook has put in place, token data may still be stored in files on third-party computers, Symantec warned.
“Concerned Facebook users can change their Facebook passwords to invalidate leaked access tokens,” Doshi said.
“Changing the password invalidates these tokens and is equivalent to ‘changing the lock’ on your Facebook profile.”
Source: http://news.malaysia.msn.com/top-stories/article.aspx?cp-documentid=4833542
Please support us so that we can continue to bring you more Dharma:
If you are in the United States, please note that your offerings and contributions are tax deductible. ~ the tsemrinpoche.com blog team
A simple and effective security tip is to change your passwords regularly, eg once every three months. Of course it is Facebook’s and other service providers’ responsibility to protect their users and maintain privacy, but as users, we better look after our own security otherwise, when you get attacked, there is nothing that Facebook or you can do.
It’s very irresponsible for websites like facebook to not protect their users. Many problems arise when users’ private info are easily accessible. It’ll be good if there are government bodies that would penalize companies that don’t ensure their users’ privacy.
You cannot imagine how easy your identity can be stolen online. No matter how safe or secure you think it is, any 3rd party applications or online social networks have your entire profile and information at their hands!
Lets say for instance you go through someone’s facebook account, you can (almost most of the time, usually) make out who they are, what they do, where they are, what they like, who their friends are, what their hobby is, what they are currently doing, their birthday (most of the time)… its quite easy for your identity to be stolen huh!
The worldwide web, for an average user, is never safe…
I noticed that facebook has many privacy issues. I always read on the internet that Facebook is having an issue here and there. I believe that Facebook should update their privacy everyday. If children have their accounts revealed publicly, it would open a doorway to evil pedophiles to hunt down children. I am very worried about the state of facebook nowadays. I am very lucky that I have not encountered any difficulties on Facebook regarding privacy. I hope that there will be no more issues with facebook. I think that it would be good if they give an potion to users whether they want to have their profiles viewed publicly or if they do not want to and they need to ask the question twice in case someone picks the wrong answer the first time.
I hope Symatec improves and does not involve itself with the access tokens of Facebook. To prevent anything like this to happen again. Symatec also should update their security daily.