Facebook bug let websites see users' likes, interests

Another Facebook vulnerability risked personal user information

Basically the search results lacked security against a cyber attack known as a Cross-Site Request Forgery (CSRF) which could embed iFRAME to access portions of user data from your logged-in Facebook profile.

"A unique feature of the uncovered bug is the exploitation of the iframe element within Facebook's search feature". If the user interacts with this page in any possible manner such as scrolling or clicking, the page will automatically execute malicious JavaScript code that will automate the search queries in a new tab. A CSRF attack is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts.

Fortunately, there are no cases of the bug being implemented and Facebook patched it before the details were made public.

The bug (which has already been fixed by Facebook) was reportedly found months ago by Imperva's security researcher Ron Masas. The vulnerability was tied to Facebook on Google's Chrome browser, which accounts for more than 60 percent of browsers used online.


Masas had proven this security issue when he created a malicious web page on which an attacker could lure any user.

"This allowed information to cross over domains - essentially meaning that if a user visits a particular website, an attacker can open Facebook and can collect information about the user and their friends", Masas said. Some of the examples given include finding out whether a user took photos at certain locations, has friends from any specific country, or they've written a post with a specific text.

A Facebook spokesman explained the company's reaction to the bug. He said that the vulnerability revealed the user as well as their friends' interests even if their privacy settings were such so that only user's friends could see their interests. And given that Masas was on a vulnerability hunt, we suspect that such a bug isn't something that opportunistic hackers would stumble across. Facebook declined to comment on who was behind the hack, saying it was still under FBI investigation, but The Wall Street Journal reported that it was likely spammers posing as a digital marketing company.

In a statement shared with TechCrunch, Facebook spokesperson Margarita Zolotova wrote, "We appreciate this researcher's report to our bug bounty program".

Related News:

  • Facebook Admits It ‘Encourages’ Employees to Use Android Smartphones, Not iPhones

    Facebook Admits It ‘Encourages’ Employees to Use Android Smartphones, Not iPhones

    When asked what he would have done if he was in place of Zuckerberg, Cook had said, "I wouldn't be in this situation". Cook said that Apple wouldn't traffic in a customer's personal life and that privacy was a human right.
    Pro-govt forces halt Yemen port offensive as UAE backs talks

    Pro-govt forces halt Yemen port offensive as UAE backs talks

    Four employees in Hodeida port who requested anonymity told AFP that a rebel commander had been killed in the attack on Monday. The UN refugee agency (UNHCR) said about 445,000 people have fled Hodeida province since June.
    Deepika and Ranveer married in a 4-hour-long Konkani Brahmin ritual

    Deepika and Ranveer married in a 4-hour-long Konkani Brahmin ritual

    The same day, Ranveer and close friend and casting director Shanoo Sharma were spotted from his balcony at a "haldi" ceremony. After they exchanged rings, he gave a speech that made her emotional, according to one website.
  • Couple, homeless man charged with faking story that earned $400K in donations

    Couple, homeless man charged with faking story that earned $400K in donations

    McClure and her boyfriend Mark D'Amico then set up a GoFundMe page to help Bobbitt, raising almost $400,000 from well-wishers. WTXF reports the Burlington County Prosecutor will announce more information at a press conference at 2 p.m. on Thursday.
    Artist's impression of Barnard's Star and its super-Earth

    Artist's impression of Barnard's Star and its super-Earth

    However, the new data contain tentative hints of a second planet orbiting Barnard's Star even further out than the Super-Earth. At almost 6 light-years away, the star is the next closest star to the Sun after the Alpha Centauri triple stellar system.
    Lakers game tonight: Lakers vs Trail Blazers

    Lakers game tonight: Lakers vs Trail Blazers

    He had 26 points and his season high of 12 rebounds in a 128-119 loss at Portland in the season opener on October 18. The 12-year veteran is averaging 9.3 points, 6.8 assists and 4.8 rebounds per game in his first Lakers campaign.
  • Oil price to reach $137 in 2040?

    Oil price to reach $137 in 2040?

    Still, oil consumption will continue to grow in coming decades, due to rising petrochemicals, trucking and aviation demand. Electricity will account for a quarter of energy used by end users such as consumers and industry by 2040, it said.
    IT'S HERE: The John Lewis Christmas Ad 2018

    IT'S HERE: The John Lewis Christmas Ad 2018

    A rep for Elton said: "The speculation in recent months around Elton's fee for appearing in the ad has been wildly inaccurate". Sir Elton is played by actors throughout the advert, except for the opening and closing scenes.
    Saudi top prosecutor seeks death penalty in Khashoggi murder

    Saudi top prosecutor seeks death penalty in Khashoggi murder

    Others have argued it's hard to believe the killing would have taken place without Crown Prince Mohammed bin Salman's knowledge. Former Saudi deputy intelligence chief Ahmad al-Assiri was the highest-level official behind the killing, the prosecutor said.
  • 'Too short' Tom Cruise to be replaced for Jack Reacher reboot

    'Too short' Tom Cruise to be replaced for Jack Reacher reboot

    After playing the action hero Jack Reacher in two Hollywood films , Tom Cruise won't be stepping into his enormous shoes again. Who should play Jack Reacher on the small screen? "I really enjoyed working with Cruise ".
    Mithali slams fifty as India thrashes Pakistan

    Mithali slams fifty as India thrashes Pakistan

    After a steady 94-run partnership between Maroof and Dar, Pakistan managed to score a total of 133/7 in their 20 overs. Australia now top Group B of the event as they defeated Ireland by nine wickets at Guyana's Providence Stadium today.
    Chelsea among five Premier League clubs facing transfer ban

    Chelsea among five Premier League clubs facing transfer ban

    An additional three-window ban was reportedly added due to the club's signings of several other players who were under 18. European giants like Atletico Madrid and Barcelona have also been handed transfer bans in recent seasons.


Most liked

Premier League to introduce VAR next season
The Premier League's 20 clubs chose to introduce VAR at a meeting on Thursday, pending approval from soccer's lawmakers. VAR is already in use across the majority of Europe's major leagues including La Liga, the Bundesliga and Serie A.

Curran, Buttler save England against Sri Lanka spin
Captain Joe Root (14) was bowled off an inside edge as Malinda Pushpakumara, making a return to the test XI, made an impact. However, Dhananjaya de Silva's 59, which was quite similar to the innings from Jos Buttler , kept Sri Lanka in the hunt.

‘Doctor Who’ New Year’s Day Special Set On BBC America
Per BBC America, Doctor Who's Whittaker-led Season 11 has been averaging almost 1 million viewers, up 54 percent vs. Whittaker's first full episode attracted a record audience for a new Doctor - 10.9 million viewers - last month.

Monkey kills newborn after grabbing baby from breastfeeding mom
This is the latest incident in a spate of monkey attacks in Agra , where they have become increasingly desensitised to humans. A monkey has snatched a 12-day-old Indian boy from his mother and killed him, police said.

Researchers Have Created an Artificial Sun, And It’s Way Hotter
Numerous world's other energy sources, such as coal, produce carbon when processed, which contributes to climate change. China's Experimental Advanced Superconducting Tokamak, or " artificial Sun " as it is better known.

Cristiano Ronaldo And Georgina Rodriguez Are Engaged!
The family stepped out at the O2 Arena to watch Novak Djokovic and John Isner face off during a singles round robin match. The Serbian explained he has previously crossed paths with Ronaldo as he is a big tennis fan.

Former England and Chelsea star Joe Cole retires
I feel I can offer a lot as a coach and have really enjoyed the opportunity to undertake some of these duties with the Rowdies. He wrote the post at Instagram in which thanked "countless people have helped" him through that path.

Eli Manning Rolls Back the Years, Will Giants Stick with Him Again?
There were only 53 seconds left on the clock when Manning threw to Sterling Shepard for a 3-yard touchdown to win the game. Mullens completed 27 of 39 passes for 250 yards with a touchdown and two interceptions. "He played his game".

PS4 Black Friday 2018 sales include a cheap Spider-Man bundle
I think we get a cut for PS4 (to $249) and Pro (to $349) around Black Friday , but the pricing now makes RDR look like it's free. Apparently this is also just a preview of the full sale, with "more details "to be confirmed soon".

Edinburgh named as one of first United Kingdom cities for EE’s 5G upgrade
Each 5G site will boast transmission links of up to 10Gbps and connect to the Petabit-class BT 21CN backbone network. There's also the cost of using 5G with EE confirming it will be more expensive than current 4G price plans.

All That Social Media May Boost Loneliness
These effects were more prominently observed among the students who came into the study already having depression . However, Hunt said the findings do not suggest that 18- to 22-year-olds should stop using social media altogether.

Canada in talks with Pakistan over possibly taking in Asia Bibi
The charge also carries the death penalty and critics say the controversial blasphemy law is abused to settle religious scores. In 2011, the governor of Punjab province was killed by his own guard after he defended Bibi and criticized the blasphemy law.

Barack and Michelle Obama Will Return to Hyde Park for Publicity Events
"And for this I'd never forgive him". "But you all being here tonight is a testament to the light". "I might even tap Sasha". Obama is on a media blitz promoting her new book, " Becoming ", which was released on Tuesday.

SAP buying experience management firm Qualtrics for $8 billion
The tech industry's newest billionaires are a pair of brothers who started a software company in their parents' basement in Utah. CNBC reported that SAP has been looking to add new cloud-based products as it moves away from desktop-focused software.

Shahid Afridi: Pakistan can not manage its own four provinces, doesn’t need Kashmir
The Indian media had also adopted a harsh stance against and alleged Afridi of being an agent of Pakistan's intelligence agency. And before that, way back in 2016, Afridi had suggested that a lot of Kashmiri fans supported Pakistani cricketers.