Facebook's security has been called into question after the creators of a new blog discovered a hack that can expose private profile information of any user.
Facebook's security has been called into question after the creators of a new blog discovered a hack that can expose private profile information of any user.The creators of a new blog called FBHive showed how they could see everything listed in a Facebook user's "Basic Information" panel, regardless of the privacy settings they had chosen.
Using the security hole, they were able to view personal information about Facebook CEO Mark Zuckerberg, Digg founder Kevin Rose, and popular blogger Cory Doctorow. Of course, personal data, such as your date of birth, can be valuable information for identity thieves.
The folks at FBHive went public with proof that they had exploited the security flaw by posting screenshots of the Internet celebrities' details, seemingly frustrated that after waiting more than two weeks, Facebook had still not patched the flaw.
These screenshots have now been (quite rightly) obfuscated to protect the identities of the peopleconcerned, and Facebook has now fixed the vulnerability.
FBHive published a short video demonstrating how they were able to exploit the flaw to examine a user's profile.
It's great that Facebook has now fixed this flaw, but disturbing that the vulnerability existed in the first place -- millions of Facebook users potentially could have been in danger of having information snatched that they believed was secure.
Of course, this isn't the first time Facebook has found itself in the spotlight for not properly securing its users' information. Just last month, a security loophole was found that could have allowed identity thieves and spammers to gather users' personal email addresses.
Maybe people need to learn that if they really want to be secure on social networks, they shouldn't rely on the Website keeping their date safe and sound -- that maybe it's better not to upload any personal information in the first place.
After all, do you really need to tell Facebook your real date of birth?
Graham Cluley is senior technology consultant at Sophos, and has been working in the computer security field since the early 1990s. When he's not updating his other blog on the Sophos website you can find him on Twitter at @gcluley. Special to Dark Reading.
Enterprise Vulnerabilities From DHS/US-CERT's National Vulnerability DatabaseCVE-2018-14623 PUBLISHED: 2018-12-14
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulne...