Feeds

Facebook scrambles to close hole exposing private data

Gives attacker almost as much control as user

Providing a secure and efficient Helpdesk

Facebook engineers are finishing a patch for a critical vulnerability that exposed user birthdays and other sensitive data even when they were designated as private, a security researcher said Wednesday.

The bug could be exploited by prompting a user to click on a link while logged into the social networking site, said M.J. Keith, a senior security analyst with Alert Logic, a provider of cloud-based intrusion detection systems. Attackers could then read, delete, or alter a victim's profile page, including pictures and data that are set to be viewed only by trusted friends.

"I would assume that every single Facebook user [could] have [had] their Facebook page defaced or have exposed things about them," Keith told El Reg. The bug "gives the attacker almost as much control as the user."

At time of writing, much of the CSRF (cross-site request forgery) bug appeared to have been patched, Keith said. However, as noted earlier by IDG News, attackers still could exploit the flaw to control a user's "like" functions, which are used to endorse ads and other types of content.

Facebook representatives didn't respond to an email asking about the status of the bug fix.

The flaw involved a piece of code Facebook engineers dubbed "post_form_id," which is used to ensure that commands can be issued only by browsers that have previously logged into the website. Keith discovered a simple way to bypass the security token: by omitting it altogether, Facebook servers no longer attempted to validate browsers.

It's at least the second glitch to compromise Facebook user privacy this month. Nine days ago, Facebook had to temporarily disable the site's live chat function to contain a bug that allowed users to eavesdrop on their friends' conversations.

Keith's advisory is here. ®

Update

A Facebook spokesman sent us a statement that included the following:

"Alert Logic reported a CSRF vulnerability to us, and we worked quickly to resolve it. We're in the process of confirming that all endpoints have been patched. We maintain a strong relationship with security experts around the world and work closely with them in the rare instances in which they find vulnerabilities."

He also noted that people can report Facebook vulnerabilities here.

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.