Feeds

Facebook plugs email address indexing bug

It's just not your month, is it, dear?

5 things you didn’t know about cloud backup

Incident-prone social network monolith Facebook has plugged yet another security leak, this time involving the indexing by search engines of email addresses not listed on Facebook.

Thousands of email addresses submitted using Facebook's "Find a friend" feature that were not tied to a Facebook account wound up getting indexed by Google, according to Blogger Cory Watilo, who was among those affected. The "Find a Friend" feature allows friends to hunt for acquaintances on Facebook by email address, so those exposed have their so-called mates to thank for any exposure.

"One obvious problem is that spammers can easily scrape this data and add easily legitimate address to their lists, many of whom might not give their addresses to Facebook for a reason," Watilo writes.

The issue sparked a lively discussion thread on Hacker News.

Facebook changed its robot.txt file to prevent the search engine from indexing the relevant "opt out of emails from Facebook" page so that email address data can no longer be harvested by spammers or other miscreants.

However, it told the AllFacebook blog that that its actions were only a precaution and that the email address exposure resulted from users inadvisedly published their own addresses on mailing lists rather than a fault on its part.

We are investigating this situation but in cases we have identified, Facebook users have republished e-mails from Facebook elsewhere on the Internet, making public their own e-mail addresses. In some instances, these venues have been personal blogs or public mailing list archives such as Yahoo Groups. As a precaution, we have stopped indexing these pages in Google but cannot control users who choose to republish their e-mails in blogs or mailing list archives.

Security experts are unsure of the root cause of the problem in this case, but the snafu represents the latest in a long line of security snafus involving the site over recent weeks - a factor that means many are disinclined to give it the benefit of the doubt.

Over recent days many Facebook users have been hit by a run of clickjacking attacks, taking advantage of the social network's "Like" facility. The ruse results in users endorsing a page as something they like without necessarily realising they are recommending it to all of their Facebook friends and contacts.

A fortnight ago Facebook admitted that it mistakenly gave advertisers data that might be used to discover users' names and locations, contrary to its privacy policy. MySpace made much the same error which resulted from coding errors in failing to obscure the URL of the user's profile page before handing over reports to advertisers.

In the last month the social network has also grappled with a flaw that created a means for hackers to delete Facebook friends, and a bug that allowed users to eavesdrop on IM chats, forcing the social network to suspend the feature while it applied a fix.

That's just a sample of the security problems affecting Facebook since the start of May alone and ignores the privacy controversies brewing since the December privacy roll-back. These were made worse by more recent plans to share users' details with selected third-party sites that forced the site to simplify its privacy controls last week. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.