DawgTalkers.net Forums DawgTalk Tailgate Forum Facebook bug spills name and pic for all 500 million users

Quote:

---

http://www.theregister.co.uk/2010/08/11/facebook_name_extraction_bug/
Facebook bug spills name and pic for all 500 million users


A bug in Facebook's login system allows attackers to match unknown email addresses with users' first and last names, even when they've configured their accounts to make that information private.

The information leak can be exploited by social-engineering scammers, phishers, or anyone who has ever been curious about the person behind an anonymous email message. If the address belongs to any one of the 500 million active users on Facebook, the social-networking site will return the full name and picture associated with the account.

"Facebook users have no control over this, as this works even when you have set all privacy settings properly," Atul Agarwal of Secfence Technologies wrote Wednesday on the Full-disclosure security listserve. "Harvesting this data is very easy, as it can be easily bypassed by using a bunch of proxies."

Exploiting the vulnerability is as easy as entering the email address into the Facebook sign-on page, typing a random password and hitting enter. To streamline the attack, Agarwal has written a PHP script that works with large lists of email addresses.

Over the past few years, Facebook has come under criticism for revealing too much information about its users. The data — which can include users' birthdays, home towns and personal friends — can then be used by marketers, stalkers, and other ne'er-do-wells to invade the users' privacy. The social-networking site has responded by giving users more control over who gets to see select pieces of user information.

Evidently, the name-to–email address extraction bug has been overlooked. We wouldn't be surprised to see this fixed in short order. ®


Link to Original Post and Exploit finding on Seclist.org below
http://seclists.org/fulldisclosure/2010/Aug/130

---

Quote:

---

This script extracts the First and Last Name (provided by the users when
they sign up for Facebook). Facebook is kind enough to return the name even
if the supplied email/password combination is wrong. Further more,it also
gives out the profile picture (this script does not harvest it, but its easy
to add that too). Facebook users have no control over this, as this works
even when you have set all privacy settings properly. Harvesting this data
is very easy, as it can be easily bypassed by using a bunch of proxies. - Atul Agarwal - Secfence Technologies


http://seclists.org/fulldisclosure/2010/Aug/130

---

Quote:

---

no need to attempt to harvest, 100 million+ accounts have already been retrieved and a torrent is available of all 1.2GB of data.

---

Quote:

---

I wouldn't be surprised if that isn't a result of it.

XXX sites, spammers and virus writers could download the profiles and search them for specific demographics (male, 18-55, etc...) and target them.
I've gotten a number of those invites recently as well, but I've received them as long ago as a year or more, too. They may or may not want you to actually friend them, but they definitely want you to click the link to "view their pictures", which almost certainly is a link to a page crafted to steal information or infect your computer.

---

Man, I haven't got any of those invites. I must be so ugly that they won't go near me.

Quote:

---

It amazes me how many friend I have that have their email, telephone, cell, and home address in their profile info.

---

I've accidentally called like 3 people who have never given me their number lol.

My phone is linked to Facebook, so if your profile has your number on it, your number is automatically in my phone.

It's kind of embarrassing to call someone who has never given you their number

Quote:

---

the last couple of days, I've received several requests to allow folks to be my friend.. But I have no idea who they are and mutual friends aren't listed.

Oddly enough, all were women with relatively sexy pictures (not revealing, just sexy)

I've denied them access because it sounded fishy, is this kinda what's happening?

I even had a friend request from someone named Tawny something.. it slipped past me and she or it has been posting links on my facebook page...

damn

---

I've gotten 10-15 friend requests over the past several months all from women in revealing photos or poses. I've tried adjusting my security settings but that doesn't seem to be helping.

Just last week a woman claiming to be a police officer from Wisconsin sent me a private message on facebook saying she found my wallet and asked if I could come and retrieve it. Too bad I've never been to Wisconsin.

Quote:

---

If I request someone I haven't seen or talked to in a long time I always include a personal message of how I know them.

---

Quote:

---

That's very odd to me.. I am not the type that visits pornsites so I'm assuming you don't have to visit such sites to get hit by those kind of solititations.

---

Quote:

---

Purp, you know I'm not an IT guru.. ha,, not even close really.. so this may seem like a very stupid question, but is phishing done only to retrieve information that can be used to scam someone out of money? are there other reasons to scam?

I ask that because when I look at some of the things I"ve read about,, I can't understand how it will result in any financial benefit.

---

Quote:

---

There are times that I receive emails from myself.. Meaning, I get an email at my business email address and it's FROM ME.. only I didn't send it.

---

it's called multiple personality syndrome

Quote:

---

I do wish that people would include their MB names if they do a friends request as a result of kowing someone else on the boards. (Not that I even log onto facebook more than once a month anyway ......)

---

Hey it's me GM... oh wait your already on my face book. Never mind

Quote:

---

It's called address spoofing and is the biggest PITA for me here. I can filter our most spam emails, but the spoofed ones become harder to filter. So I have the filter send out a report every 4 hours during the workday to the users for them to review for legit emails form the "possible spam" folder.

if they find a legit email in the list, they can clear it for deliver and the pass the filter in the future.

---

Quote:

---

I don't do facebook because I don't need a computer screen telling me how few friends I have. If I want to know, I can count them up on my fingers

---

Quote:

---

http://m.cnn.com/primary/_9fy5f6-iUs8lPQSoQ

So facebook has this new app that let's friends know where there phone is. So if you go to applebees on main street, your status is updated to "John smith" has checked into applebees, main street. Brilliant.

Now they need an app that let's people know where your spare house key s, or maybe your bank pin

---

Quote:

---

http://m.cnn.com/primary/_9fy5f6-iUs8lPQSoQ

So facebook has this new app that let's friends know where there phone is. So if you go to applebees on main street, your status is updated to "John smith" has checked into applebees, main street. Brilliant.

Now they need an app that let's people know where your spare house key s, or maybe your bank pin

---

Quote:

---

www.whatsthemagicword.com

Didn't realize that's how they came across

---

The magic word is PrplPplEater is great and grand and I should listen to what he says when he says to stop posting things in a certain way...

but yeah.. mobiles websites do not translate well on a pc... in fact.. I couldn't even see the last two mobile links I clicked here..

But good thing my evil twin Bob signed up for Facebook for me...

Quote:

---

www.whatsthemagicword.com

Didn't realize that's how they came across

---

Hmmm .... dunno.

"You must login to view this site."

Quote:

---

Quote:

---

http://m.cnn.com/primary/_9fy5f6-iUs8lPQSoQ

So facebook has this new app that let's friends know where there phone is. So if you go to applebees on main street, your status is updated to "John smith" has checked into applebees, main street. Brilliant.

Now they need an app that let's people know where your spare house key s, or maybe your bank pin

---

So basically it is Google latitude for Facebook?

---

Quote:

---

It's like when you're in jail and get an extra meal for good behaviour.

---

So it's prison rape if you don't share?

Quote:

---

Never heard of foursquare

---