Application Security

4/5/2018
12:55 PM
50%
50%

Facebook: Most Profiles Likely Scraped by Third Parties

Facebook announces plans to restrict data access after 87 million users' data was improperly shared with Cambridge Analytica.

Data belonging to most of Facebook's 2 billion users could have been accessed without their consent, the social media company announced this week. As a result, it's taking steps to restrict the amount of information accessible to outside parties by removing certain features.

The changes announced this week affect Facebook's Events API, Groups API, Pages API, Facebook Login, Instagram Platform API, Call and Text History, Data Providers and Partner Categories, and App Controls. Starting April 4, 2018, for example, Facebook will need to approve all apps requesting access to data like photos, posts, check-ins, events, and groups.

One of the most critical changes affects Search and Account Recovery. Until April 4, users could search for people using their phone number or email address. This feature has been deleted following the realization malicious actors have abused it to scrape public profile data by submitting phone numbers and email addresses they already have through account recovery.

"Given the scale and sophistication of the activity we've seen, we believe most people on Facebook could have had their public profile scraped in this way," the company says. Facebook also reports the data of about 87 million people was taken by Cambridge Analytica without users' consent. Most of those affected are in the United States.

The extent of changes demonstrates a shift in Facebook's relationship with third-party apps, which could previously access users' events, relationship statuses, and other information.

Read more details here.

Interop ITX 2018

Join Dark Reading LIVE for a two-day Cybersecurity Crash Course at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the agenda here. Register with Promo Code DR200 and save $200.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.