Facebook Flaw Exposed Private Photos 201
Velcroman1 writes "A security hole in Facebook allowed almost anyone to see pictures marked as private, an online forum revealed late Monday. Even pictures supposedly kept hidden from uninvited eyes by Facebook's privacy controls aren't safe, reported one user of a popular bodybuilding forum in a post entitled 'I teach you how to view private Facebook photos.' Facebook appears to have acted quickly to eliminate the end-run around privacy controls, after word of the exploit spread across the Internet. It wasn't long before one online miscreant uploaded private pictures of Facebook founder Mark Zuckerberg himself — evidence that the hack worked, he said."
Again? (Score:5, Insightful)
Re:Again? (Score:5, Funny)
Re:Again? (Score:4, Insightful)
Re: (Score:3, Funny)
I can't wait for it to be "horrifying security hole in Linux" twice a day. That should be a lolfest.
Any day now, Linux should be crawling with viruses.
Any day now.
Re:Again? (Score:4, Funny)
Re:Again? (Score:4, Funny)
I'm still waiting for the era of Solaris workstation
Re: (Score:2)
Re: (Score:3, Insightful)
To you. It's a troll to anybody who's tired of seeing this trotted out every time there's a story that can be even vaguely linked.
Re:Again? (Score:5, Insightful)
And no friend of yours uses facebook?
And no one you ever was in a party with?
And no one who has your adress in their gmail contact list?
Facebook is a threat not limited to its users.
Re: (Score:2)
Slashdot users with RL friends? Who go to parties with them? Resulting in interesting pictures?
You must be new here. ;-)
Re: (Score:2)
OH MY GOD! You mean someone might just see a photo of my dog? STOP THE PRESSES, MY PRIVACY HAS BEEN RAPED.
The Facebook "threat" to privacy is overblown. I've got a Facebook account. I hardly use it, and don't really have much there. The pictures of me that ARE there are just fishing trip pictures posted by other people. Why the hell should I care who can see them?
So you dont care that FB harvests PII (personally identifiable info) from your freinds and can add more info to your account than you wish to surrender to them yourself?
While some of the privacy issues are overblown, there are some disturbing trends. One other fun one is "shadow profiles".
Supposedly FB is compiling the info they harvest from your freinds' contact lists and "creating" profiles for people who arent on FB yet.
For example, your coworker "Bob" isnt on facebook. You are, as well as a dozen or so
Re: (Score:2)
Facebook has become the 1990's MS of the 2010's. Every week a new exploit.
Re:Again? (Score:4, Insightful)
If you don't want private stuff to be exposed then don't post it. It's that simple. When you upload/post stuff, you have no control over it. But you can still use Facebook to stay in touch.
Re:Again? (Score:5, Insightful)
Oh you missed the fun part brother. It's not whether you post it, it's I post you on it. You can't stop it, you can't delete it.
Re:Again? (Score:4, Funny)
By the way I of course don't use Facebook.
Of course (Score:5, Insightful)
If you upload something to Facebook, assume anyone can see it. Whether it's a genuine hack, somebody figuring out your password, or leaving a computer logged in while you go grab coffee, somebody will at some point have access to everything, so don't upload it in the first place. It's that simple.
That means don't complain profusely about your boss every day, don't send explicit messages to you lover, and certainly don't use Facebook to archive those pictures of that wild bachelor party.
Re:Of course (Score:5, Insightful)
Always assume anything on facebook is visible to everyone always. You no longer have any control, it is never deleted, never removed.
It is why i have never used facebook ever. It isnt worth it. While i do know some has posted pictures of me, those pictures cant truely be linked to me.
Re:Of course (Score:5, Insightful)
... While i do know some has posted pictures of me, those pictures cant truely be linked to me.
That is, until the other user imports their contact lists with your email addresses and phone numbers into Facebook, and starts tagging pictures of you, and they correlate others's address books with you in them. Then Facebook has a good idea who you are and who your "friends" are without you ever logging in.
Re:Of course (Score:5, Funny)
If you upload something to Facebook, assume anyone can see it...
Ah, you misspelled Internet.
Re:Of course (Score:5, Funny)
If you upload something to Facebook, assume Internet can see it...
Ah, you misspelled Internet.
I've taken the liberty of making the correction on your behalf.
Re: (Score:2)
If you upload something to Internet, assume anyone can see it...
Ah, you misspelled Internet.
I've taken the liberty of making the correction on your behalf.
I think that was the correction he was talking about.
Re:Of course (Score:4, Funny)
If you upload pr0n to Internet, make sure I can see it...
Ah, you misspelled Internet.
I've taken the liberty of making the correction on your behalf.
I think that was the correction he was talking about.
Sorry, it still wasn't right.
Re: (Score:3)
Rules for civilized public discourse still apply.
Granted Face Book really needs to fix it privacy and security to be much better. But Facebook is a Social Media site. Meaning information posted is meant to be posted socially.
Re: (Score:2)
Re:Of course (Score:5, Funny)
That means don't complain profusely about your boss every day, don't send explicit messages to you lover, and certainly don't use Facebook to archive those pictures of that wild bachelor party.
But I hate my boss; he's a total asshole! And my boyfriend loves getting steamy messages (hey, Brian, I'm not wearing panties today. Surprise for when you get home after work! ;) ), and I archive all the bachelor parties that I perform at. I need to have a portfolio after all! How will the next bachelor party find out if they want me vs. that skank across town?
Click here [youtube.com] to visit my private webpage, for my special webpage (Registration, and credit card required)
Re:Of course (Score:4, Insightful)
(hey, Brian, I'm not wearing panties today. Surprise for when you get home after work! ;) )
This is the classic problem of how to properly close a parenthetical statement that ends with an emoticon.
Re:Of course (Score:4, Funny)
The easy fix, in this case, is to use more tongue. ;p
Comment removed (Score:5, Funny)
Re: (Score:3)
User name/post combo of the day!
Re:Of course (Score:5, Funny)
You can tell he's a coder because he substituted the placement instead of thinking about it as being "inside" a layer which must be closed regardless of the last character. Other people see the aesthetics of one vs two )'s and one for many *looks* better. As a coder we know we didn't properly close our parens.
Programmers through process.
Ok I'm inside a parens.
content.
more content.
smiley
Ok, I have to close this parens.
==
Normal person's thought process.
==
Ok I'm whispering, so I need to start with a (
content.
more content.
Now I'm done. (looks at the sentence, and thinks a single closing paren looks better, does not add another one)
Re: (Score:2)
(hey, Brian, I'm not wearing panties today. Surprise for when you get home after work! ;) )
This is the classic problem of how to properly close a parenthetical statement that ends with an emoticon.
Another semantic nugget I wanted to add, is when you use slash to separate two things ("cat/dog"). If an item consists of multiple words, you should cover it in curly brackets so that you know what words the option covers ("cat/{big dog}").
So technically the sentences "Today I'm going to fix the garage/kitchen door" and "Today I'm going to fix the garage/{kitchen door}" are two different things. In the first one you're either fixing the door of garage or kitchen. In the second one you're either fixing the w
Re: (Score:2, Funny)
hey, Brian, I'm not wearing panties today. Surprise for when you get home after work! ;)
I just discovered that I assume that everyone on Slashdot is male, and that guys who wear panties for their boyfriend Brian kind of skeeve me out.
Learn something new every day...
Re: (Score:2)
Well, of course, if you "perform" professionally at bachelor parties, then perhaps your Facebook page is a marketing tool for your entertainment business. In that case, it should present an image suitable to your profession. If that means insulting your boss to help potential customers identify with you, then so be it.
Re: (Score:2)
You're very talented! I haven't seen such classic moves in a while. Cool voice, too.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Just get it from her Facebook profile...
I mean, c'mon, it's not like it's hard...
Re: (Score:2)
It's hard.
Some of my best friends are strippers (Score:2, Informative)
One of them had the idea that she could shock me by giving me her business card that bore a professionally photographed wide-open beaver shot.
If you're anywhere near Santa Cruz, California, Seraphina Landgrebe does excellent erotic photography. I rang her up once in hopes that she could do a nice portrait for use as a Valentine's Day gift, but I did not yet have the kind of relationship with that young lady that would have made Seraphina's suggestion that I pose while clad in nothing but a leopard-print jo
Re: (Score:2)
Re: (Score:2)
I'll second that. Assuming she's a she.
Re: (Score:3)
FTFY
Assume the worst. If you want something private, don't tell ANYONE.
Re: (Score:2)
Re: (Score:2)
If you upload something to Facebook, assume anyone can see it.
Personally, I assume that Mark Zuckerberg can see it, if he so chooses, and I trust him less than my least trustworthy friend.
Re:Of course (Score:4, Interesting)
If you upload something to Facebook, assume anyone can see it
I used to think this, but there are some pretty convincing arguments in The Net Delusion that have caused me to rethink that position. There are a lot of Facebook users, and dissident groups cannot avoid using Facebook to reach people, simply because of the large number of people on Facebook. If Facebook does not take privacy seriously, the risk to dissidents who try to contact their fellow citizens on Facebook will grow.
The point here is that yes, it is a problem when Facebook unexpectedly opens its users' data to the world against their wishes. There are legitimate reasons why someone might use Facebook but want to keep their account data private.
Re:Of course (Score:4, Interesting)
Newsflash: any dissidents attempting to use Facebook are being plain stupid. That's like sending an email containing your entire list of friends and family to every government in the world, but with way more detail about what you do and where you are.
You do realize that Facebook privacy terms only apply to other users who use Facebook for free, and follow the terms of service, right? Facebook hackers, bots, and government agencies (and likely some large corporations) have full access to Facebook data. So does Facebook. Not only is your "private" Facebook data fair game, so is the "hidden" Facebook data, such as your access log, answers to security questions, access patterns (when you did what), etc.
Re: (Score:3)
If you upload something to Facebook, assume anyone can see it.
In general, this is true of anything you post on the Internet. I look at it this way: try to avoid posting things on Facebook, Twitter, Google+, Slashdot, Flickr, or any other site, that you might be embarrassed for a family member to see, or a future potential employer. If it's on the Internet, assume anyone can see it.
My immediate personal response to this Facebook flaw: ohmigosh! Then I remembered that my photos are pretty much my cats, work we've done on the house, flowers, speakers at events, and simil
Re:Of course (Score:5, Funny)
You do understand that these forums are often frequented by folks who have forgotten more about computer security that most folks will learn during the course of their entire lives?
Interesting (Score:3, Interesting)
I wonder what constitutes a "private photo" for Zuckerberg, my guess is he has no photos that would be even remotely interesting since he knows the ins and outs of FB, and why does spell check want to turn "zuckerberg" into "rubbernecker"?
It's all related somehow...
Surprised this is real. (Score:5, Interesting)
I saw a link to the forum discussing this somewhere. From the description of the "hack", I was certain this is a hoax. You see, the idea is that the hack is to report the user with private pictures to facebook as having "nude/pornographic" images, and in the image flagging process it shows you private-only pics as well.
So it really sounded like a hoax to me to have people go around reporting private profiles of hot girls (or even boys I guess), and I am surprised it is a real security flaw. Not that you can call something on facebook a security flaw, since that would require security in the first place, right?
Re:Surprised this is real. (Score:5, Interesting)
Re: (Score:3)
It didn't. It took that long for the "popular bodybuilding forum" to archive those pictures guaranteed to improve its popularity.
Re: (Score:2)
Re: (Score:2)
Definitely real (Score:2, Informative)
I decided it was real when I saw someone post Zuck's photos [imgur.com].
Re: (Score:3)
If ever I thought there was a link that would go to goatse, that was it. But, no, the photos are of Zuckerberg fully clothed. Not mounting a goat or anything along those lines.
Private pictures? (Score:5, Interesting)
Re:Private pictures? (Score:5, Funny)
Then I'm guilty of not wanting people to be jealous of my naked body.
Re:Private pictures? (Score:4, Informative)
"If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place," Eric Schmidt
Not quite... but close.
Re: (Score:2)
BTW if you want to google that you might be surprised at how hard that is to find, try this "google ceo privacy quote"
Re: (Score:2)
There are two kinds of people in the world.
Those who dark secrets tend to be they type that might be revealed over the internet, and those whose aren't.
Re:Private pictures? (Score:5, Insightful)
I confess: I have an Internet stalker (Score:2)
Some guy over at Kuro5hin who I know only as modus [kuro5hin.org] got the idea that I am some manner of dangerous criminal psychopath because I was so inconsiderate of his easily-wounded feeling to point out that, after two decades of working as a coder, I was weary of the work and wanted to change careers by going back to school to learn how to compose symphonies.
If you look at his comment and diary history at his user info page I linked above, you'll find that the vast majority of them are focussed entirely on me, quite
thank you mark. (Score:5, Funny)
A squirrel dying in front of your house may be more relevant to your interests right now than people dying in Africa. -Mark Zuckerberg
No Mark,
The private pics of the girl I crush on, yes, those are more relevant to my interests than people dying in Africa. Thank you for giving me occasional glimpses of hope with your privacy blunders.
Yours Sincerely,
Creep.
A bug? In software? OH MY! (Score:5, Insightful)
Unless we're going to start regulating social networks like we do products for some other industries, then, well, there's a reasonable likelihood of this sort of thing happening on a regular basis. If you don't like it, don't share stuff on Facebook.
Re: (Score:2)
don't share stuff on Facebook.
No real comment, I just thought this deserves repeating.
Re: (Score:2)
Regulating social network software might actually be a good idea. Not as in restricting content, but as in requiring certain standards to be met. Like it or not, we live in a connected world where information is shared, collated and mined. Errors in that data are next to impossible to correct because they spread faster than you can correct them. In the absence of data privacy laws, it is essential that the calibre of software be such that inappropriate access is kept to an absolute minimum.
Having said that,
Re: (Score:2)
From what I hear from friends who have recently interviewed at Facebook, right now there are apparantly banners hung on the walls in the Facebook offices that say "Don't test, just ship." Every developer has the power to push code to production.
There's considerable space for improvement in quality here before getting to some sort of certification program; for example "a social network should have some QA, more than none" seems like it would be an improvement.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Sure, but it helps to have a system that is designed from the ground up with privacy in mind, rather than having it bolted on when people scream bloody murder.
Re: (Score:2)
I was thinking of designing a p2p social network as a thought exercise. Such a network would re
Re: (Score:3)
You have to assume that things will slip through of course.
This particular bug could easily have been prevented by making all object requests pass through a layer that implements some form of mandatory access control. But given this story it's obvious there's no such layer in Facebook, and it's up to the developers to bake uniform security policies into every feature they implement. This is a problem that following the DRY principle would have prevented.
But this kind of thing happen all the time in software
Did You Really Authorize All Those FB Apps? (Score:5, Informative)
The other day I finally got around to configuring those privacy settings that everyone has been so on about. Facebook sure doesn't make them easy to find.
I was shocked to find that my account granted access to about three dozen apps that I never even heard of. There were only two or three that I signed up for with my own conscious knowledge. I don't have the first clue how I got signed up for all the rest.
That just pissed me off. As I was no longer actually using the two or three apps that I did voluntarily use, I deleted all three dozen from my account.
You may be completely unaware that a whole bunch of private companies that are not affiliated with Facebook have access to your personal data. Even if you want to use a particular Facebook app, you should configure that particular app's privacy settings to grant it access only to the data you voluntarily want it to have. If you are no longer using an app, or don't recall ever requesting the use of it, you should delete it from your account completely.
Here's what you do:
Log in to your Facebook account. (Heh, when I did that just now, I found my account locked. It turned out to be because I had deleted my cookies, not because Facebook caught me spreading the word about how to dump what Facebook considers to be its real customers!)
At the top-right is your username, "Friends", "Home" and a small triangle. Click on the small triangle then select "Privacy Settings".
Click on "Edit Settings" to the right of "Apps and Websites". You may need to scroll down a little bit.
Click on "Edit Settings" to the right of "Apps You Use".
I no longer use any apps so I can't continue from here, but at this point it should be pretty clear what to do.
Some apps really will require access to your details so they can function. If so, be certain that you really want to continue using those apps. Give them the minimum level of access that you really want them to have. Delete all the rest.
Re: (Score:2)
You may be completely unaware that a whole bunch of private companies that are not affiliated with Facebook have access to your personal data
Anyone who is unaware of that fact clearly does not understand Facebook's business model.
Want To Provide A Valuable Public Service? (Score:2)
Point out that fact to all of your Facebook friends.
After I deleted all that Apps from my FB profile, I pointed out what I'd done on my FB wall.
One of my FB Friends immediately replied to thank me for doing so, and told me that it was only because of my advice that she knew to do the same thing for her own profile.
Re: (Score:2)
Here's Why I Really Do Need To Use Facebook (Score:2)
The vast majority of old friends that I want to find again don't have the first clue how to use Google.
While I'm pretty good at "Feeling Lucky" myself, the kind of people who don't know how to use Google also tend not to appear anywhere on the Web under their own real names.
One of my very best friends during my Freshman year of high school was a fellow Roman Soldier in Armijo High School's production of Jesus Christ Superstar. I'm handy with tools, so with the help of Ted and the other tool-handy Roman Sol
What kind of photos? (Score:2)
Surprisingly weak architecture (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
The pictures (Score:5, Interesting)
Re: (Score:2)
Regardless of THIS flaw (Score:5, Informative)
Please know that on Facebook, whatever your privacy settings are, your photos are only secured by the obscurity of the URL. The Facebook servers that serve static content do so efficiently by doing nothing else. No cookies, no session management, etc. If you happen to know the url of an image (not the facebook url that wraps the image but the actual resource url) you can view it from anywhere whether or not you are logged in.
Re:Regardless of THIS flaw (Score:5, Informative)
So creeps, grab those URLs from your cache while you can.
Re:Regardless of THIS flaw (Score:5, Informative)
Yeah. And if for some reason, you share it to someone.. and they post it anywhere, and google pics up the url, forget it:
https://www.google.com/search?q=a3.sphotos.ak.fbcdn.net/hphotos-ak-snc7&oe=utf-8um=1&ie=UTF-8&hl=en&tbm=isch&source=og&sa=N&tab=wi [google.com]
You can also run a search for partial image names through the google image search api [google.com] using facebook known static content servers.
Re: (Score:2)
In addition to that if you have the static URL to the photo it persists after the photo has been deleted as well.
Well, that's to be expected when using a static cache - it's the only way DNS can manage, for example (DNS changes take a while to "propagate" through the Internet).
If the deleted content is still there a week or more later, then you've got problems.
Re:Regardless of THIS flaw (Score:5, Informative)
Re:Regardless of THIS flaw (Score:5, Interesting)
If the deleted content is still there a week or more later, then you've got problems.
We're talking about Facebook here. The content is never deleted, and that's by design.
Re:you can't trust 3rd parties with private info (Score:5, Insightful)
It's not my cup of tea; but the notion that one could usefully improve one's security by simply replacing facebook with a personally implemented private network is roughly similar to the notion that one can usefully improve one's security by severing one's LAN from the internet.
Both are true; but not terribly useful for most users.
Re: (Score:2)
no no no ... these are great fun.
Re: (Score:2)
i'm not sure you isn't a test of a moron.
i'm not sure if you isn't a test of a moron either mate.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Flamebait)
Fox News calling someone a "miscreant" is like Idi Amin calling someone "a big meanie".
Re: (Score:2)
All the QA in the world won't help if the findings of the QA engineers do not result in defects being acknowledged or fixed. QA in those cases is not a testing group; it's a rubber stamp for which the question "do we ship it" is required to be "yes". This arises either because QA reports to a development manager (i.e. someone whose performance review is based what is released how close to schedule under budget, therefore someone who simultaneously has the motivation and the power to ignore QA findings), or
Re: (Score:2)