Facebook's security has been called into question after the creators of a new blog discovered a hack that can expose private profile information of any user.
Facebook's security has been called into question after the creators of a new blog discovered a hack that can expose private profile information of any user.The creators of a new blog called FBHive showed how they could see everything listed in a Facebook user's "Basic Information" panel, regardless of the privacy settings they had chosen.
Using the security hole, they were able to view personal information about Facebook CEO Mark Zuckerberg, Digg founder Kevin Rose, and popular blogger Cory Doctorow. Of course, personal data, such as your date of birth, can be valuable information for identity thieves.
The folks at FBHive went public with proof that they had exploited the security flaw by posting screenshots of the Internet celebrities' details, seemingly frustrated that after waiting more than two weeks, Facebook had still not patched the flaw.
These screenshots have now been (quite rightly) obfuscated to protect the identities of the peopleconcerned, and Facebook has now fixed the vulnerability.
FBHive published a short video demonstrating how they were able to exploit the flaw to examine a user's profile.
It's great that Facebook has now fixed this flaw, but disturbing that the vulnerability existed in the first place -- millions of Facebook users potentially could have been in danger of having information snatched that they believed was secure.
Of course, this isn't the first time Facebook has found itself in the spotlight for not properly securing its users' information. Just last month, a security loophole was found that could have allowed identity thieves and spammers to gather users' personal email addresses.
Maybe people need to learn that if they really want to be secure on social networks, they shouldn't rely on the Website keeping their date safe and sound -- that maybe it's better not to upload any personal information in the first place.
After all, do you really need to tell Facebook your real date of birth?
Graham Cluley is senior technology consultant at Sophos, and has been working in the computer security field since the early 1990s. When he's not updating his other blog on the Sophos website you can find him on Twitter at @gcluley. Special to Dark Reading.
5 Emerging Cyber Threats to Watch for in 2019Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
How Enterprises Are Attacking the Cybersecurity ProblemData breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Enterprise Vulnerabilities From DHS/US-CERT's National Vulnerability DatabaseCVE-2019-6485 PUBLISHED: 2019-02-22
Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5...
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc...
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file...
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parser...
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcom...