Facebook Bug Allowed Websites Access to Users’ Likes and Interests

• A bug was discovered in Facebook that allowed access to information from user’ profiles without their knowledge.
• The bug was discovered by security researcher Ron Masas from Imperva.
• The bug has already been fixed, and Facebook has recognized the researcher’s contributions.

A security researcher from Imperva found a security bug that left Facebook vulnerable to cross-site request forgery (CSRF) attacks. Websites were able to get access to any Facebook user’s “likes” and “interests.” While data websites had access to does not leak any personal information, it can be very valuable to advertising companies for demographic data.

Imperva’s security researcher Ron Masas revealed “This allowed information to cross over domains — essentially meaning that if a user visits a particular website, an attacker can open Facebook and can collect information about the user and their friends. The vulnerability exposed the user and their friends’ interests, even if their privacy settings were set so that interests were only visible to the user’s friends.”

Malicious websites could open multiple Facebook search queries in a standalone tab and run queries to find out if users like a particular page or not through “yes” and “no” responses for collecting data. These queries could be modified to retrieve even more detailed information like the names of friends who like a page in the query or even personal demographic data.

It is unknown if any websites took advantage of the exploit so far. Facebook has acknowledged the contributions by Masas as part of the bug bounty program and has patched the issue. The issue is not restricted to Facebook alone, and the web standard as a whole need to prevent such exploits from running amok. The social media company has revealed that they did not see any signs of abuse and user data is safe. The social media giant has had a long string of scandals including the Cambridge Analytica incident in 2017 and the more recent user token theft. Fortunately, a timely bug report has prevented the CSRF bug from being exploited.

What do you think about the Facebook bug? Let us know in the comments below. Get instant updates on TechNadu’s Facebook page, or Twitter handle.